CVE-2026-28256
Trane Tracer Sc Firmware ≤ 4.4
Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-28256 is a medium-severity Use of Hard-coded, Security-relevant Constants (CWE-547) vulnerability in Trane Tracer Sc Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28256 is a Use of Hard-coded, Security-relevant Constants vulnerability (CWE-547) in Trane Tracer SC, Tracer SC+, and Tracer Concierge. Published on 2026-03-12, it could allow an attacker to disclose sensitive information and take over accounts. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impacts across confidentiality, integrity, and availability.
An unauthenticated attacker with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation enables disclosure of sensitive information, account takeover, and potential disruption of system availability, leveraging the hard-coded constants to bypass security controls.
The CISA ICS advisory ICSA-26-071-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01 provides further details on mitigation and recommended actions for addressing this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11637
Vulnerability Data
A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Documented configuration settings externalize security-critical values so they are not hard-coded in source.
Requiring a documented development process and standards can mandate use of symbolic names for constants.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of named constants and configurable values for security parameters.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC processes can catch hard-coded constants during reviews and testing.
Secure coding standards explicitly prohibit hard-coded security constants.
Change management may detect constant changes but does not prevent their initial hard-coding.
Configuration management can externalize constants but does not directly address coding practice.