# CVE-2026-28253: Trane Tracer SC, Tracer SC+ and Tracer Concierge Memory Allocation with Excessive Size Value (Unauthenticated DoS)

> CVE-2026-28253 is an unauthenticated, network-reachable denial-of-service flaw (CWE-789) in the HTTP/BACnet server of Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers. Claroty Team82 found it; Trane fixed it in Tracer SC+ v6.30.2313 and CISA published ICSA-26-071-01 on 2026-03-12. No public exploitation was reported.

- **Published:** 2026-10-14T22:59:13Z
- **Last reviewed:** 2026-10-14T22:59:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3561
- **ID:** TL-2026-3561
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28253, CVE-2026-28252

## Description

CVE-2026-28253 is a 'Memory Allocation with Excessive Size Value' vulnerability (CWE-789) in Trane Tracer SC, Tracer SC+ and Tracer Concierge. An unauthenticated remote attacker can cause a denial-of-service condition. NVD scores it CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CVSS 4.0 8.7 HIGH. CISA's advisory lists the same flaw with a CVSS 3.0 vector of the same shape.

Technical mechanism (per the Team82 research as summarized by trade press): the affected HTTP and BACnet server does not limit HTTP header size and keeps allocating memory while it receives data that contains no newline characters. A single network-reachable client can therefore push the controller toward resource exhaustion and disrupt the service. SentinelOne's summary similarly describes requests that make the system try to allocate memory blocks far exceeding available resources. Public sources do not name the exact port or protocol, and no public proof-of-concept is documented.

The flaw is one of five vulnerabilities Claroty Team82 reported (researcher credited by CISA: Noam Moshe) in the Tracer family, covered by CISA ICSA-26-071-01: CVE-2026-28252 (broken cryptographic algorithm in the Trane Diagnostic Service; deterministic challenge-response; root shell if SSH is manually enabled), CVE-2026-28253 (this DoS), CVE-2026-28254 (unauthenticated API routes disclosing device information), CVE-2026-28255 (hard-coded remote-service credentials shared across devices) and CVE-2026-28256 (hard-coded encryption constants for configuration, backups and firmware updates). Trane fixed CVE-2026-28252/28253/28254 in Tracer SC+ v6.30.2313; the other two were addressed with cloud-side security controls.

Affected: Tracer SC firmware before v4.4 SP7, and Tracer SC+ and Tracer Concierge before v6.3.2310 (the Claroty dashboard lists all versions as affected and recommends v6.30.2313 for Tracer SC+). CISA reported no known public exploitation at publication time. Tenable and SentinelOne also list no known exploits. These controllers are HVAC/building-management devices, including in data centers, so loss of availability can affect facility operations. Defenders should patch, keep the controllers off the public internet, and monitor for oversized or newline-free HTTP headers and repeated crashes or restarts of the Tracer web service.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Application or System Exploitation
- T0814 Denial of Service

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-28253](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-28253)
- [CISA ICS Advisory ICSA-26-071-01 - Trane Tracer SC, Tracer SC+, and Tracer Concierge](https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01)
- [NVD - CVE-2026-28253](https://nvd.nist.gov/vuln/detail/CVE-2026-28253)
- [Tenable OT Security plugin 505313 - Trane Tracer Memory Allocation with Excessive Size Value (CVE-2026-28253)](https://www.tenable.com/plugins/ot/505313)
- [SentinelOne Vulnerability Database - CVE-2026-28253](https://www.sentinelone.com/vulnerability-database/cve-2026-28253/)
- [Danfoss, Copeland and Trane address controller security vulnerabilities (RefIndustry)](https://refindustry.com/news/danfoss-copeland-and-trane-address-controller-security-vulnerabilities/)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-28252 (companion Tracer vulnerability)](https://blog.claroty.com/team82/disclosure-dashboard/cve-2026-28252)
- [Action1 - CVE-2026-28253 Trane Tracer SC](https://www.action1.com/vulnerabilities/cve-2026-28253/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3561