Read the docs
TI-2026-22568 Aliases CVE-2026-28252GHSA-mvqv-5q67-w9vh

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

Priority MEDIUM 41CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.

Summary

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix Fixed Tracer SC (Trane): v4.4 SP7Tracer SC+ (Trane): v6.3.2310+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TraneTracer SCbefore v4.4 SP7v4.4 SP7Patch availableCNA
TraneTracer SC+before v6.3.2310v6.3.2310Patch availableCNA
TraneTracer Conciergebefore v6.3.2310v6.3.2310Patch availableCNA
  • Tracer SC VendorTrane Affected before v4.4 SP7 Fixed in v4.4 SP7 Patch available CNA
  • Tracer SC+ VendorTrane Affected before v6.3.2310 Fixed in v6.3.2310 Patch available CNA
  • Tracer Concierge VendorTrane Affected before v6.3.2310 Fixed in v6.3.2310 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:trane:tracer_sc_firmware:*:*:*:*:*:*:*:*up to 4.4VulnerableTrane
cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack1:*:*:*:*:*:*4.4 service_pack1VulnerableTrane
cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack2:*:*:*:*:*:*4.4 service_pack2VulnerableTrane
cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack3:*:*:*:*:*:*4.4 service_pack3VulnerableTrane
cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack4:*:*:*:*:*:*4.4 service_pack4VulnerableTrane
cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack5:*:*:*:*:*:*4.4 service_pack5VulnerableTrane
cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack6:*:*:*:*:*:*4.4 service_pack6VulnerableTrane
cpe:2.3:h:trane:tracer_sc:*:*:*:*:*:*:*:*all versionsRunning onTrane
cpe:2.3:o:trane:tracer_sc\+_firmware:*:*:*:*:*:*:*:*before 6.3.2310VulnerableTrane
cpe:2.3:h:trane:tracer_sc\+:*:*:*:*:*:*:*:*all versionsRunning onTrane
  • cpe:2.3:o:trane:tracer_sc_firmware:*:*:*:*:*:*:*:* Versions up to 4.4 Vulnerable ·Trane
  • cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack1:*:*:*:*:*:* Versions 4.4 service_pack1 Vulnerable ·Trane
  • cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack2:*:*:*:*:*:* Versions 4.4 service_pack2 Vulnerable ·Trane
  • cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack3:*:*:*:*:*:* Versions 4.4 service_pack3 Vulnerable ·Trane
  • cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack4:*:*:*:*:*:* Versions 4.4 service_pack4 Vulnerable ·Trane
  • cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack5:*:*:*:*:*:* Versions 4.4 service_pack5 Vulnerable ·Trane
  • cpe:2.3:o:trane:tracer_sc_firmware:4.4:service_pack6:*:*:*:*:*:* Versions 4.4 service_pack6 Vulnerable ·Trane
  • cpe:2.3:h:trane:tracer_sc:*:*:*:*:*:*:*:* Versions all versions Running on ·Trane
  • cpe:2.3:o:trane:tracer_sc\+_firmware:*:*:*:*:*:*:*:* Versions before 6.3.2310 Vulnerable ·Trane
  • cpe:2.3:h:trane:tracer_sc\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Trane
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:trane:tracer_concierge:*:*:*:*:*:*:*:*before 6.3.2310VulnerableTrane
  • cpe:2.3:a:trane:tracer_concierge:*:*:*:*:*:*:*:* Versions before 6.3.2310 Vulnerable ·Trane

Remediation

  • Fix · CNA Tracer SC (Trane) Fixed in v4.4 SP7
  • Fix · CNA Tracer SC+ (Trane) Fixed in v6.3.2310
  • Fix · CNA Tracer Concierge (Trane) Fixed in v6.3.2310

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Trane Tracer Concierge, Tracer SC, Tracer SC+ v4.4 SP7, v6.3.2310

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-22569 Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergePriority MEDIUM 44
    • TI-2026-22571 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergePriority LOW 36
    • TI-2026-22570 Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergePriority LOW 36
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28252
  2. 2026-10-03 Alias added: GHSA-mvqv-5q67-w9vh

References

Advisory 1

  • TI-2021-16050 Trane Tracer Code Injection CVSS 3.1CRITICAL 9.9
  • TI-2026-22569 Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge CVSS 4.0HIGH 8.7
  • TI-2026-22571 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge CVSS 4.0HIGH 8.2
  • TI-2026-22570 Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge CVSS 4.0MEDIUM 6.9
  • TI-2026-22572 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences