title: Trane Building Automation Controllers Cross-site Scripting
description: The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Tracer SC
vendor: Trane
versions:
lessThanOrEqual: 3.8, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]
solutions: Trane has identified the following specific mitigations for the affected products:
Users upgrade Tracer SC controllers running firmware v3.8 and prior,  to firmware  v4.4 SP7 or higher. Users should contact a regional Trane office to install updated firmware or request additional information and reference Trane service database number HUB-207592.
Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends users identify a migration plan to replace the Tracer SC controller with  the Tracer SC+ controller, which can function as a drop-in replacement for Tracer SC, providing significant security upgrades.