Vulnerability · Published Mar 12, 2026 · Assigned by icscert
CVE-2026-28255Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
High 8.2
In plain English
A high-severity hard-coded credentials in Tracer Concierge from Trane. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.3%top 77.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trane | Tracer SC | 0 – before v4.4 SP7 |
| Trane | Tracer SC+ | 0 – before v6.3.2310 |
| Trane | Tracer Concierge | 0 – before v6.3.2310 |
Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01 government-resource