title: Trane Symbio Improper Control of Generation of Code
description: The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
product: Symbio
vendor: Trane
versions:
lessThan: 1.00.0023, status: affected, version: 700, versionType: custom
lessThan: 1.00.0007, status: affected, version: 800, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
]
solutions: Affected users should contact a Trane representative to install updated firmware or request additional information. Please reference Trane service database number HUB-205962 when contacting the Trane office.
Trane has identified the following specific mitigations:
Symbio 700 controllers: Upgrade to v1.00.0023 or later
Symbio 800 controllers: Upgrade to v1.00.0007 or later
In addition to the specific recommendations above, Trane continues to recommend the following best practices as an additional protection against this and other controller vulnerabilities:
Restrict physical controller access to trained and trusted personnel.
Use secure remote access solutions, such as Trane Connect Remote Access, when needed.
Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).
Have a well-documented process and owner to ensure regular software/firmware updates and keep systems up to date.