CVE-2026-28252

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - ics-cert@hq.dhs.gov

Published

2026-03-12

Last modified

2026-03-13

Weaknesses

CWE-327

Affected products

• Tracer Concierge (Trane)
• Tracer Sc (Trane)
• Tracer Sc+ Firmware (Trane)
• Tracer Sc Firmware (Trane)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01