CVE-2026-28256

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - ics-cert@hq.dhs.gov

Published

2026-03-12

Last modified

2026-03-12

Weaknesses

CWE-547

Affected products

• Tracer Concierge (Trane)
• Tracer Sc (Trane)
• Tracer Sc+ Firmware (Trane)
• Tracer Sc Firmware (Trane)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01