CVE-2026-28255
Published: 12 March 2026
Summary
CVE-2026-28255 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Trane Tracer Sc Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw Remediation requires identifying, prioritizing, and applying patches for vulnerabilities like this hard-coded credentials issue as detailed in the CISA advisory.
Authenticator Management mandates changing default and hard-coded authenticators prior to use, directly preventing exploitation of embedded credentials.
Account Management supports monitoring for anomalous activity and disabling accounts taken over through the hard-coded credentials vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded credentials (CWE-798) directly provide valid/default accounts that unauthenticated remote attackers can use against the exposed ICS web/management interface (T1190/T1133), resulting in account takeover via T1078/T1078.001.
NVD Description
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
Deeper analysisAI
CVE-2026-28255 is a Use of Hard-coded Credentials vulnerability (CWE-798) affecting Trane Tracer SC, Tracer SC+, and Tracer Concierge systems. Published on 2026-03-12, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts across confidentiality, integrity, and availability.
The vulnerability enables remote exploitation over the network by unauthenticated attackers requiring no privileges or user interaction, with low attack complexity. Successful attacks could allow disclosure of sensitive information and takeover of accounts on affected systems.
CISA's ICS Advisory ICSA-26-071-01 provides details on this vulnerability; practitioners should consult it for recommended mitigations and patch information.
Details
- CWE(s)