Skip to main content

Tracer Sc Firmware CVE-2026-28255

HIGH
Use of Hard-coded Credentials (CWE-798)
2026-03-12 ics-cert@hq.dhs.gov
Authentication Bypass Tracer Sc Firmware Tracer Concierge Trane
8.2
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 19:57 vuln.today
CVE Published
Mar 12, 2026 - 18:16 nvd
HIGH 8.2

DescriptionCVE.org

A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Analysis

A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Use of Hard-coded Credentials (CWE-798).

RemediationAI

Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

More in Tracer Sc Firmware

View all
CVE-2026-28252 CRITICAL
9.2 Mar 12

Trane Tracer SC, SC+, and Concierge building automation controllers use broken cryptographic algorithms that allow attac
CVE-2021-38450 HIGH
8.8 Oct 27

The affected controllers do not properly sanitize the input containing code syntax. Rated high severity (CVSS 8.8), this
CVE-2026-28253 HIGH
8.7 Mar 12

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could a
CVE-2026-28254 MEDIUM
6.9 Mar 12

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticate
CVE-2026-28256 MEDIUM
6.9 Mar 12

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge coul
CVE-2021-42534 MEDIUM
6.1 Oct 22

The affected product’s web application does not properly neutralize the input during webpage generation, which could all

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-28255 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy