CRITICAL🇵🇱 Wersja polska

CVE-2026-28252

CVSS 9.2v4.0pub. 2026-03-12upd. 2026-03-27

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Trane Tracer Concierge

    APP
    Trane
    < 6.3.2310

  • Trane Tracer Sc

    HW
    Trane
    wszystkie wersje

  • Trane Tracer Sc\+

    HW
    Trane
    wszystkie wersje

  • Trane Tracer Sc Firmware

    OS
    Trane
    4.4≤ 4.4

  • Trane Tracer Sc\+ Firmware

    OS
    Trane
    < 6.3.2310
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2021-38450CRITICAL9.9ten sam produkt

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker c...

CVE-2026-28253HIGH8.7ten sam produkt

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concier...

CVE-2026-28255HIGH8.2ten sam produkt

A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow...

CVE-2016-4526HIGH7.5ten sam produkt

ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the packa...

CVE-2026-28256MEDIUM6.9ten sam produkt

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Conc...