# CVE-2026-28255: Trane Tracer SC / Tracer SC+ / Tracer Concierge Use of Hard-coded Credentials

> Claroty Team82 disclosed CVE-2026-28255, a hard-coded credentials flaw (CWE-798) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers. Encrypted credentials for Trane remote services are shared globally across devices and can be decrypted with hard-coded Blowfish keys, enabling information disclosure and account takeover. CISA scored it CVSS v3 6.8 (Medium); the CNA record carries CVSS v4 8.2.

- **Published:** 2026-10-14T21:25:06Z
- **Last reviewed:** 2026-10-14T21:25:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3553
- **ID:** TL-2026-3553
- **Severity:** MEDIUM (CVSS 6.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28255

## Description

CVE-2026-28255 is one of five vulnerabilities (CVE-2026-28252 through CVE-2026-28256) reported by Noam Moshe of Claroty Team82 to CISA and published in ICS advisory ICSA-26-071-01 on 2026-03-12. The advisory covers Trane Tracer SC (< v4.4_SP7), Tracer SC+ (< v6.3.2310) and Tracer Concierge (< v6.3.2310), HVAC and building-automation controllers deployed worldwide in the Critical Manufacturing sector (vendor headquartered in Ireland). The CISA impact statement for the set is that successful exploitation could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service.

CVE-2026-28255 specifically: the device configuration files contain encrypted credentials for Trane remote services. The same credentials are distributed to all devices globally, and the Blowfish decryption keys are hard-coded constants (tracked separately as CVE-2026-28256). Team82 decrypted the stored values with the hard-coded keys and recovered cleartext service-account credentials for multiple Trane global servers. Some credentials also use guessable or retrievable values such as the device serial number, which is exposed by unauthenticated APIs (CVE-2026-28254). The result is unauthorized access to Trane remote-service infrastructure and potential lateral movement into connected systems. CISA scores the flaw CVSS v3 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, CWE-798); the CVE record (CNA) lists CVSS v4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N); Tenable.ot lists CVSS v3 9.8 and VPR 4.9, so scoring varies by source.

Team82 describes the five flaws as a progressive chain against Tracer SC+ (tested up to v5.20.1362 and v6.2): unauthenticated API reconnaissance (CVE-2026-28254: /evox/tis/websocketTunnelStatus, /evox/bacnet/report, /uidata/hui/NavTreeData.hui), credential and key extraction (CVE-2026-28255/28256), SSH root shell via a deterministic PAM challenge-response (CVE-2026-28252, pam_TraneAuthenitcate.so, SSH disabled by default), and a pre-auth DoS in the HydraMain HTTP receiver (CVE-2026-28253, TEvoHttpReceiver::recvLine, unbounded buffer growth to ~2GB). Team82 highlights data-center cooling control as a high-impact target.

Remediation: Trane released Tracer SC+ v6.30.2313 (v6.3 line, released 2026-03-01), which CISA lists as addressing CVE-2026-28252, -28253 and -28254; for CVE-2026-28255 and CVE-2026-28256 CISA states that cloud security controls and enhanced security measures were implemented. Tracer SC fix is reported as v4.4_SP7 by a secondary source. Tenable reports no known public exploits. No threat actor, in-the-wild exploitation or network IOCs are reported in the sources.

## MITRE ATT&CK

- T1590.004 Network Topology
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1552.001 Credentials In Files
- T1018 Remote System Discovery
- T1021.004 SSH
- T1499.004 Application or System Exploitation

## Sources

- [Claroty Team82 Disclosure: CVE-2026-28255](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-28255)
- [CISA ICS Advisory ICSA-26-071-01: Trane Tracer SC, Tracer SC+, Tracer Concierge](https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01)
- [CVE Record CVE-2026-28255 (CVE Program)](https://cveawg.mitre.org/api/cve/CVE-2026-28255)
- [Team82: Turning Up the Heat - Hacking Trane HVAC Controllers](https://claroty.com/team82/research/turning-up-the-heat-hacking-trane-hvac-controllers)
- [Tenable.ot plugin 505315: Trane Tracer SC/SC+/Concierge Use of Hard-Coded Credentials (CVE-2026-28255)](https://www.tenable.com/plugins/ot/505315)
- [Danfoss, Copeland and Trane address controller security vulnerabilities](https://refindustry.com/?p=78759)
- [Security Arsenal: Critical Flaws in Trane Tracer Controllers Expose HVAC Systems to Root Attacks](https://securityarsenal.com/blog/critical-flaws-in-trane-tracer-controllers-expose-hvac-systems-to-root-attacks)
- [SentinelOne Vulnerability Database: CVE-2026-28255](https://www.sentinelone.com/vulnerability-database/cve-2026-28255/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3553