The vulnerability stems from hard‑coded, security‑relevant constants embedded within Trane Tracer SC, Tracer SC+, and Tracer Concierge. These hard‑coded credentials can be accessed by an attacker, potentially allowing the disclosure of sensitive configuration data and the takeover of user accounts. The weakness is classified as a credential disclosure issue (CWE‑547), affecting confidentiality and integrity of the system. No availability impact is described.

The affected products are Trane Tracer Concierge, Tracer SC, and Tracer SC+. Vendor Trane has identified these products for remediation. No specific firmware or software version ranges are provided in the data, so any device running these products may be vulnerable until patched.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is less than 1%, suggesting low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the use of hard‑coded credentials implies that an attacker could gain access either locally or remotely if they can read the device’s configuration. Exploitation would require the attacker to read the credential store and use the credentials to authenticate to the device’s management interface. The attack vector is inferred based on the description, but exact details are not explicitly stated in the data.