title: Trane Tracer Code Injection
description: The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
product: Tracer SC
vendor: Trane
versions:
lessThan: 4.4 SP7, status: affected, version: All, versionType: custom
}
{
product: Tracer SC+
vendor: Trane
versions:
lessThan: 5.5 SP3, status: affected, version: All, versionType: custom
}
{
product: Tracer Concierge
vendor: Trane
versions:
lessThan: 5.5 SP3, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
version: 3.1
]
solutions: Affected users should contact a Trane representative to install updated firmware or request additional information. Please reference Trane service database number HUB-205962 when contacting the Trane office.
Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.
Trane has identified the following specific mitigations:
Tracer SC: Upgrade to v4.4 SP7 or later
Tracer SC+: Upgrade to v5.5 SP3 or later
Tracer Concierge: Upgrade to v5.5 SP3 or later