Home

Description

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

PUBLISHED Reserved 2026-02-25 | Published 2026-03-12 | Updated 2026-03-13 | Assigner icscert




CRITICAL: 9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

Product status

Default status
unaffected

Any version before v4.4 SP7
affected

Default status
unaffected

Any version before v6.3.2310
affected

Default status
unaffected

Any version before v6.3.2310
affected

Credits

Noam Moshe of Claroty reported these vulnerabilities to CISA. finder

References

www.cisa.gov/news-events/ics-advisories/icsa-26-071-01 government-resource

cve.org (CVE-2026-28252)

nvd.nist.gov (CVE-2026-28252)

Download JSON