A missing authorization flaw (CWE‑862) in Trane Tracer SC, Tracer SC+, and Tracer Concierge enables an attacker without credentials to read data exposed by several device APIs, thereby compromising the confidentiality of data that should be protected and potentially facilitating further exploitation such as credential harvesting or configuration manipulation.

The vulnerability affects Trane’s Tracer Concierge, Tracer SC, and Tracer SC+ products. Firmware builds of Tracer SC from version 4.4 service packs 1 through 6 are impacted, and all API endpoints in Tracer SC+ are also vulnerable. These systems typically run on HVAC control units that expose management interfaces over the local network.

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild; the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires network access to the device’s exposed APIs, meaning that devices on unsecured or poorly segmented segments could be exposed to unauthenticated data disclosure. A patch is available for Tracer SC+ (v6.30.2313), but no fixed releases are publicly listed for Tracer SC or Tracer Concierge as of this advisory.