high7.5
CVE-2026-28254
A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive informat…
Impact
A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Trane | Tracer Sc Firmware | through 4.4 Version 4.4 |
| Trane | Tracer Sc\+ Firmware | before 6.3.2310 |
| Trane | Tracer Concierge | before 6.3.2310 |