Trane Tracer SC, Tracer SC+, and Tracer Concierge are affected by a use of hard‑coded credentials flaw, classified as CWE‑798. The vulnerability allows an adversary to authenticate using embedded credentials, thereby gaining unauthorized access to system functions. This can result in the disclosure of sensitive information and the takeover of user accounts, compromising confidentiality and integrity of the managed assets.

The affected products are Trane Tracer Concierge, Tracer SC, and Tracer SC+. Firmware versions include Trane Tracer SC+ firmware 4.4 across service packs one through six, as well as unspecified earlier releases of Tracer SC and Tracer Concierge. Trane has released updated firmware that removes the hard‑coded credentials in these editions.

The CVSS score is 8.2, indicating a high severity impact, while the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. This vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is remote access to the device’s management interface, where the embedded credentials can be supplied, allowing an attacker to bypass authentication and obtain privileged control over the system.