Skip to main content

Tracer Sc Firmware CVE-2026-28256

MEDIUM
Use of Hard-coded, Security-relevant Constants (CWE-547)
2026-03-12 ics-cert@hq.dhs.gov
Information Disclosure Tracer Sc Firmware Tracer Concierge Trane
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 19:57 vuln.today
CVE Published
Mar 12, 2026 - 18:16 nvd
MEDIUM 6.9

DescriptionCVE.org

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Analysis

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Use of Hard-coded, Security-relevant Constants (CWE-547).

RemediationAI

Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

More in Tracer Sc Firmware

View all
CVE-2026-28252 CRITICAL
9.2 Mar 12

Trane Tracer SC, SC+, and Concierge building automation controllers use broken cryptographic algorithms that allow attac
CVE-2021-38450 HIGH
8.8 Oct 27

The affected controllers do not properly sanitize the input containing code syntax. Rated high severity (CVSS 8.8), this
CVE-2026-28253 HIGH
8.7 Mar 12

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could a
CVE-2026-28255 HIGH
8.2 Mar 12

A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attack
CVE-2026-28254 MEDIUM
6.9 Mar 12

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticate
CVE-2021-42534 MEDIUM
6.1 Oct 22

The affected product’s web application does not properly neutralize the input during webpage generation, which could all

Same weakness CWE-547 – Use of Hard-coded, Security-relevant Constants

View all
CVE-2023-1712 CRITICAL POC
9.8
CVE-2025-49151 CRITICAL
9.3
CVE-2025-2081 HIGH
8.7
CVE-2025-2079 HIGH
8.7
CVE-2024-39888 HIGH
8.7
CVE-2024-41885 MEDIUM
5.6
CVE-2025-23253 LOW
2.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-28256 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy