CVE-2026-28254

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

Score

CVSS 3.1 7.5 High

Status

Analyzed - ics-cert@hq.dhs.gov

Published

2026-03-12

Last modified

2026-03-12

Weaknesses

CWE-862

Affected products

• Tracer Concierge (Trane)
• Tracer Sc (Trane)
• Tracer Sc+ Firmware (Trane)
• Tracer Sc Firmware (Trane)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01