CVE-2021-38450: Trane Tracer Code Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-27 · updated 2026-06-17
Weakness: CWE-94

Description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected products

Trane Tracer Concierge: before 5.5; 5.5 — fixed in 5.5
Trane Tracer Sc+ Firmware: before 5.5; 5.5 — fixed in 5.5
Trane Tracer SC: before 4.4; 4.4 — fixed in 4.4

How to fix

Upgrade to a fixed version: Trane Tracer Concierge 5.5; Trane Tracer Sc+ Firmware 5.5; Trane Tracer SC 4.4. Check the vendor advisory for mitigations.

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-266-02
https://us-cert.cisa.gov/ics/advisories/icsa-21-266-02

Get alerted when CVE-2021-38450 or the next vulnerability affects your stack