Skip to main content

Tracer Sc Firmware CVE-2026-28253

HIGH
Memory Allocation with Excessive Size Value (CWE-789)
2026-03-12 ics-cert@hq.dhs.gov
Information Disclosure Tracer Sc Firmware Tracer Concierge Trane
8.7
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 19:57 vuln.today
CVE Published
Mar 12, 2026 - 18:16 nvd
HIGH 8.7

DescriptionCVE.org

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

Analysis

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

Technical ContextAI

This vulnerability is classified as Memory Allocation with Excessive Size Value (CWE-789).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Tracer Sc Firmware

View all
CVE-2026-28252 CRITICAL
9.2 Mar 12

Trane Tracer SC, SC+, and Concierge building automation controllers use broken cryptographic algorithms that allow attac
CVE-2021-38450 HIGH
8.8 Oct 27

The affected controllers do not properly sanitize the input containing code syntax. Rated high severity (CVSS 8.8), this
CVE-2026-28255 HIGH
8.2 Mar 12

A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attack
CVE-2026-28254 MEDIUM
6.9 Mar 12

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticate
CVE-2026-28256 MEDIUM
6.9 Mar 12

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge coul
CVE-2021-42534 MEDIUM
6.1 Oct 22

The affected product’s web application does not properly neutralize the input during webpage generation, which could all

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-59204 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7
CVE-2021-47969 HIGH POC
8.7
CVE-2021-47944 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-28253 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy