A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 12, 2026 · NIST NVD

   Detected

   A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

2. Jun 17, 2026 · NIST NVD

   Updated

   A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

Affected

• cpe trane/tracer conciergeversion unspecified
• cpe trane/tracer sc firmwareversion unspecified
• cpe trane/tracer sc firmware4.4
• cpe trane/tracer sc+ firmwareversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2026-28255

  A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

  nvd.nist.gov

References

• Third Party Advisory · cisa.gov