Threat reportVulnerabilityTL-2026-3553
CVE-2026-28255: Trane Tracer SC / Tracer SC+ / Tracer Concierge Use of Hard-coded Credentials
CVE-2026-28255 (TL-2026-3553), also tracked as ICSA-26-071-01, is a medium-severity software vulnerability scored CVSS 6.8, first published 2026-10-14. It has no confirmed attribution, affects Trane Tracer SC, references 1 CVE (CVE-2026-28255), maps to 8 MITRE ATT&CK techniques (T1018, T1021.004, T1059.004), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 6.8/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3553
- Threat ID
- TL-2026-3553
- Also known as
- ICSA-26-071-01
- Severity
- MEDIUM
- CVSS
- 6.8 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical-manufacturing, data-centers, commercial-buildings
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in CVE-2026-28255
Malware and tooling: Blowfish (hard-coded key decryption of config files)
How CVE-2026-28255 works
Claroty Team82 disclosed CVE-2026-28255, a hard-coded credentials flaw (CWE-798) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers. Encrypted credentials for Trane remote services are shared globally across devices and can be decrypted with hard-coded Blowfish keys, enabling information disclosure and account takeover. CISA scored it CVSS v3 6.8 (Medium); the CNA record carries CVSS v4 8.2.
CVE-2026-28255 is one of five vulnerabilities (CVE-2026-28252 through CVE-2026-28256) reported by Noam Moshe of Claroty Team82 to CISA and published in ICS advisory ICSA-26-071-01 on 2026-03-12. The advisory covers Trane Tracer SC (< v4.4_SP7), Tracer SC+ (< v6.3.2310) and Tracer Concierge (< v6.3.2310), HVAC and building-automation controllers deployed worldwide in the Critical Manufacturing sector (vendor headquartered in Ireland). The CISA impact statement for the set is that successful exploitation could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service.
CVE-2026-28255 specifically: the device configuration files contain encrypted credentials for Trane remote services. The same credentials are distributed to all devices globally, and the Blowfish decryption keys are hard-coded constants (tracked separately as CVE-2026-28256). Team82 decrypted the stored values with the hard-coded keys and recovered cleartext service-account credentials for multiple Trane global servers. Some credentials also use guessable or retrievable values such as the device serial number, which is exposed by unauthenticated APIs (CVE-2026-28254). The result is unauthorized access to Trane remote-service infrastructure and potential lateral movement into connected systems. CISA scores the flaw CVSS v3 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, CWE-798); the CVE record (CNA) lists CVSS v4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N); Tenable.ot lists CVSS v3 9.8 and VPR 4.9, so scoring varies by source.
Team82 describes the five flaws as a progressive chain against Tracer SC+ (tested up to v5.20.1362 and v6.2): unauthenticated API reconnaissance (CVE-2026-28254: /evox/tis/websocketTunnelStatus, /evox/bacnet/report, /uidata/hui/NavTreeData.hui), credential and key extraction (CVE-2026-28255/28256), SSH root shell via a deterministic PAM challenge-response (CVE-2026-28252, pam_TraneAuthenitcate.so, SSH disabled by default), and a pre-auth DoS in the HydraMain HTTP receiver (CVE-2026-28253, TEvoHttpReceiver::recvLine, unbounded buffer growth to ~2GB). Team82 highlights data-center cooling control as a high-impact target.
Remediation: Trane released Tracer SC+ v6.30.2313 (v6.3 line, released 2026-03-01), which CISA lists as addressing CVE-2026-28252, -28253 and -28254; for CVE-2026-28255 and CVE-2026-28256 CISA states that cloud security controls and enhanced security measures were implemented. Tracer SC fix is reported as v4.4_SP7 by a secondary source. Tenable reports no known public exploits. No threat actor, in-the-wild exploitation or network IOCs are reported in the sources.
MITRE ATT&CK techniques used in TL-2026-3553
Discovery
Lateral Movement
Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Impact
T1499.004 Application or System Exploitation
Credential Access
T1552.001 Credentials In Files
Reconnaissance
Affected products and versions in CVE-2026-28255
- Trane — Tracer SC
Vulnerable versions: < v4.4_SP7
Fixed in: v4.4_SP7 - Trane — Tracer SC+
Vulnerable versions: < v6.3.2310
Fixed in: v6.30.2313 - Trane — Tracer Concierge
Vulnerable versions: < v6.3.2310
Remediation for CVE-2026-28255
Patches
- Tracer SC+ v6.30.2313
- Tracer SC v4.4_SP7 (per secondary reporting)
- Tracer Concierge: update to v6.3.2310 or later per CISA affected-version range
Immediate actions
- Upgrade Tracer SC+ to v6.30.2313 or later (v6.3 line released 2026-03-01)
- Remove direct Internet exposure of Tracer controller management interfaces
- Keep the Trane Diagnostic Service (SSH) disabled unless required
Workarounds
- For CVE-2026-28255 and CVE-2026-28256 CISA states Trane implemented cloud security controls and enhanced security measures
- Follow CISA ICS defensive guidance for ICSA-26-071-01
Longer-term hardening
- Segment building-automation (BACnet/LonTalk) networks from corporate and Internet-facing networks
- Allow remote access only through secured VPNs
- Monitor OT subnets for anomalous HTTP/BACnet traffic and unexpected connections to Trane remote-service endpoints
CVEs associated with CVE-2026-28255
Weaknesses (CWE) in CVE-2026-28255
Timeline of CVE-2026-28255
- CVE-2026-28255 reserved in the CVE Program; Noam Moshe of Claroty Team82 reported the Trane Tracer vulnerabilities to CISA
- Trane released Tracer SC+ v6.3 (v6.30.2313 line), the version Trane and Team82 recommend upgrading to
- Claroty Team82 disclosure-dashboard entry lists CVE-2026-28255 with fix guidance to upgrade Tracer SC+ to v6.30.2313
- CISA released ICS advisory ICSA-26-071-01 covering CVE-2026-28252 to CVE-2026-28256; CVE-2026-28255 scored CVSS v3 6.8 (Medium)
- CVE-2026-28255 published; CNA record lists CVSS v4.0 8.2 and CWE-798 for Tracer SC (<v4.4 SP7), Tracer SC+ and Concierge (<v6.3.2310)
- Security Arsenal published coverage of the Trane Tracer advisory with detection and segmentation guidance
- Tenable.ot published remote-detection plugin 505315 for CVE-2026-28255; no known public exploits reported
Sources cited for CVE-2026-28255
- Claroty Team82 Disclosure: CVE-2026-28255
- CISA ICS Advisory ICSA-26-071-01: Trane Tracer SC, Tracer SC+, Tracer Concierge
- CVE Record CVE-2026-28255 (CVE Program)
- Team82: Turning Up the Heat - Hacking Trane HVAC Controllers
- Tenable.ot plugin 505315: Trane Tracer SC/SC+/Concierge Use of Hard-Coded Credentials (CVE-2026-28255)
- Danfoss, Copeland and Trane address controller security vulnerabilities
- Security Arsenal: Critical Flaws in Trane Tracer Controllers Expose HVAC Systems to Root Attacks
- SentinelOne Vulnerability Database: CVE-2026-28255
Detection coverage for TL-2026-3553
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3553 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.