VulnSocial

CVE-2021-38450Disclosure(trane / tracer_concierge)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

trane CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • tracer_concierge
  • tracer_sc
  • tracer_sc\+
  • tracer_sc\+_firmware

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
trane
Products
tracer_conciergetracer_sctracer_sc\+tracer_sc\+_firmwaretracer_sc_firmware

3 versions affected across 5 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-02-25: 1Technical Details · 2026-02-25: 102-25
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • CtrlAltDisobey@CtrlAltDisobey
    Disclosure

    Yo @Trane_Tech @TraneCommercial 2026 and your Tracer SC+ controllers are still getting left exposed with zero auth on oBIX and known RCEs (CVE-2021-38450). Found one controlling an entire commercial HVAC setup. ISP notified too. These are physical building systems, not toys. Get them off the open internet. #OTSecurity #Hacking #ResponsibleDisclosure

    Post summary

    The tweet discloses that Tracer SC+ controllers remain exposed with zero authentication on oBIX, enabling remote code execution via CVE-2021-38450, and reports finding an exposed device controlling a commercial HVAC system, urging removal from the internet.

    1000072
    25 followersView on X
CPE platform detail8 entries

8 of 8 entries

PartVendorProductVersionTarget SWTarget HW
Apptranetracer_concierge---
Apptranetracer_concierge5.5--
HWtranetracer_sc---
HWtranetracer_sc\+---
OStranetracer_sc\+_firmware---
OStranetracer_sc\+_firmware5.5--
OStranetracer_sc_firmware---
OStranetracer_sc_firmware4.4--

Explore more

Back to dashboardtrane CVEstracer_concierge vulnerabilities