ZeroDay Findings
Sign inSign up

Findings

CVE-2026-28254

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information thro…

Published Mar 12, 2026 · updated Jun 17, 2026 · trane tracer sc firmware

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 12, 2026 · NIST NVD

    Detected

    A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

  2. Jun 17, 2026 · NIST NVD

    Updated

    A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

Affected

  • cpe trane/tracer conciergeversion unspecified
  • cpe trane/tracer sc firmwareversion unspecified
  • cpe trane/tracer sc firmware4.4
  • cpe trane/tracer sc+ firmwareversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-28254

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-28254

    A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

    nvd.nist.gov

References