# CVE-2026-28252 - Trane Tracer SC/SC+/Concierge Broken Cryptographic Algorithm Authentication Bypass

> CVE-2026-28252 is a use of a broken or risky cryptographic algorithm (CWE-327) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers. It lets an attacker bypass authentication and obtain root-level access to the device. CISA reports no known public exploitation at publication.

- **Published:** 2026-10-15T00:03:28Z
- **Last reviewed:** 2026-10-15T00:03:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3567
- **ID:** TL-2026-3567
- **Severity:** HIGH (CVSS 8.1)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28252

## Description

CVE-2026-28252 affects Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers and is tracked by CISA in ICS Advisory ICSA-26-071-01 (released 2026-03-12). The flaw is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). Per the CVE record, an attacker can bypass authentication and gain root-level access to the device. Per Claroty Team82, consequences include sensitive information disclosure, arbitrary command execution or denial of service.

Scoring differs by source. CISA and Claroty list CVSS v3 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the high attack complexity reflecting the cryptographic weakness that must be defeated. NVD and Tenable list CVSS v3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2 (AV:N/AC:H/AT:P). This record uses the CISA/Claroty 8.1 value. The public sources reviewed do not publish the specific algorithm weakness or an exploit procedure, and no PoC is referenced.

Affected versions per CISA: Tracer SC before v4.4_SP7, and Tracer SC+ and Tracer Concierge before v6.3.2310. The advisory names Tracer SC+ v6.30.2313 as the fixed release that addresses CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254. The same advisory covers CVE-2026-28253 (memory allocation overflow, DoS, CVSS 7.5), CVE-2026-28254 (missing authorization, 5.8), CVE-2026-28255 (hard-coded credentials, 6.8) and CVE-2026-28256 (hard-coded security constants, 5.8). The vulnerability was reported by Noam Moshe of Claroty Team82. CISA lists the Critical Manufacturing sector. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported to it.

CISA mitigations: network isolation of controllers, VPN for remote access, firewall protection and Trane cloud security controls. Secondary reporting suggests monitoring BACnet (UDP 47808) and HTTP/HTTPS (80/443) access to controllers from unauthorized subnets, and watching for communication gaps or device unresponsiveness as DoS indicators. That guidance comes from a secondary blog, not the advisory. The sources do not provide network IOCs, malware, or actor attribution, so no BeaconBeagle correlation applies.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-28252](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-28252)
- [CISA ICS Advisory ICSA-26-071-01 - Trane Tracer SC, SC+, Concierge](https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01)
- [NVD - CVE-2026-28252](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28252)
- [Tenable OT Security plugin 505312 - Trane Tracer CVE-2026-28252](https://www.tenable.com/plugins/ot/505312)
- [Security Arsenal - Critical Flaws in Trane Tracer Controllers Expose HVAC Systems to Root Attacks](https://securityarsenal.com/blog/critical-flaws-in-trane-tracer-controllers-expose-hvac-systems-to-root-attacks)
- [SentinelOne Vulnerability Database - CVE-2026-28252](https://www.sentinelone.com/vulnerability-database/cve-2026-28252/)
- [Action1 - CVE-2026-28252 Trane Tracer SC](https://www.action1.com/vulnerabilities/cve-2026-28252/)
- [MITRE CVE Record - CVE-2026-28252](https://cveawg.mitre.org/api/cve/CVE-2026-28252)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3567