PT-2026-25019 · Trane · Tracer Concierge+2

Noam Moshe · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-28254

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trane Tracer SC Trane Tracer SC+ Trane Tracer Concierge

Description A missing authorization flaw exists in Trane Tracer SC, Tracer SC+, and Tracer Concierge. This issue could allow an unauthenticated attacker to gain access to sensitive information through unprotected APIs. The affected API endpoints lack proper authorization checks, potentially exposing data to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-28254

Affected Products

Tracer Concierge

Tracer Sc

Tracer Sc Firmware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-28254 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-071-01 · Note
• https://twitter.com/CVEnew/status/2032230695364431988 · Twitter Post
• https://t.me/CVEtracker/47281 · Telegram Post