Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2021-38450

Trane Tracer Code Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Trane Tracer SC

  • All to < 4.4 SP7affected

Trane Tracer SC+

  • All to < 5.5 SP3affected

Trane Tracer Concierge

  • All to < 5.5 SP3affected

References