A weakened cryptographic algorithm is used in the authentication process of Trane Tracer SC, Tracer SC+, and Tracer Concierge. The flaw allows an attacker to bypass authentication, thereby granting full root privileges on the device. The vulnerability is classified under CWE‑327 and can compromise confidentiality, integrity, and availability of the control system. Once compromised, an attacker could alter or disable device functions, leading to safety risks and potential denial of service for critical HVAC operations.

The affected products are Trane Tracer Concierge and Trane Tracer SC family, including Tracer SC+, as identified by the CNA. While the description does not list specific model or firmware numbers, Trane has released an updated Tracer SC+ version (v6.30.2313) that addresses the issue. Earlier firmware revisions, such as the 4.4 service packs and other Tracer SC firmware variants, are presumed vulnerable until a patch is applied. System administrators should verify the exact hardware model and firmware version against the vendor’s advisory.

The CVSS score for this vulnerability is 9.2, indicating a high severity. EPSS indicates an exploitation probability of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation likelihood. Nevertheless, the attack vector is inferred to be remote over the network, since authentication is typically performed via network connections to the device. An attacker who successfully exploits the flaw gains unrestricted root control, making this a critical risk for any connected control environment.