PT-2026-25019 · Trane · Tracer Concierge+2

Noam Moshe · Publicado 2026-03-12 · Atualizado 2026-03-12 · CVE-2026-28254

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trane Tracer SC Trane Tracer SC+ Trane Tracer Concierge

Description A missing authorization flaw exists in Trane Tracer SC, Tracer SC+, and Tracer Concierge. This issue could allow an unauthenticated attacker to gain access to sensitive information through unprotected APIs. The affected API endpoints lack proper authorization checks, potentially exposing data to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-28254

Produtos afetados

Tracer Concierge

Tracer Sc

Tracer Sc Firmware

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-28254 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-26-071-01 · Nota
• https://twitter.com/CVEnew/status/2032230695364431988 · Publicação no Twitter
• https://t.me/CVEtracker/47281 · Publicação no Telegram