CVE-2026-28253

Executive Summary

CVE-2026-28253 is a high-severity Memory Allocation with Excessive Size Value (CWE-400) vulnerability affecting Trane Tracer SC, Tracer SC+, and Tracer Concierge building automation controllers. An unauthenticated remote attacker can trigger a denial-of-service (DoS) condition by sending specially crafted network requests that force the device to allocate an excessive amount of memory, causing the controller to crash or become unresponsive. With a CVSS score of 8.7 and a network attack vector requiring no authentication or user interaction, this vulnerability is directly reachable from the network and can disrupt building management, HVAC control, and environmental monitoring operations in critical facilities.

Technical Analysis

The vulnerability resides in how Trane Tracer SC, Tracer SC+, and Tracer Concierge handle incoming network requests during memory allocation operations. The flaw is classified under CWE-400 (Uncontrolled Resource Consumption) specifically involving a memory allocation with an excessive size value. This indicates the controller's application logic does not adequately validate size parameters embedded within network packets before invoking memory allocation routines.

The attack surface is the device's network-exposed services, likely the Building Automation and Control Network (BACnet) interface, web management interface, or proprietary Trane communication protocol handlers. When processing incoming data, the application reads a size field from the packet payload and passes it directly — or with insufficient validation — to a memory allocation function such as malloc(), calloc(), or similar. By specifying an extremely large value for this size field (e.g., 0x7FFFFFFF or larger), an attacker forces the system to request a memory block far exceeding available resources.

Because BACnet/IP operates over UDP port 47808 and the Trane web interface may be on standard HTTP/HTTPS ports, the controller's memory management becomes the critical failure point. When the allocation request fails or causes the system to exhaust its heap, the resulting conditions typically include:

1. Out-of-memory (OOM) crash — The application process aborts, taking the control logic offline.
2. System-wide resource exhaustion — Memory pressure prevents other essential processes (e.g., HVAC PID controllers, alarm handling, scheduling) from functioning.
3. Firmware watchdog reset — Some controllers may reboot, but repeated exploitation results in a persistent DoS loop.

Since the CVE data lists affected version ranges as empty, all currently deployed Tracer SC, Tracer SC+, and Tracer Concierge firmware versions prior to the patched release v6.30.2313 (for Tracer SC+) are presumed vulnerable. The patch source is the CNA (ICS-CERT), and the specific patch version for Tracer SC and Tracer Concierge has not been independently confirmed.

Exploitation Scenarios

Step 1 — Target Identification (Reconnaissance): An attacker first performs network discovery to locate Trane Tracer controllers. Using Nmap, the attacker scans for BACnet/IP service on UDP port 47808 or the typical Trane web management interface on TCP ports 80/443. A more targeted approach uses BACnet discovery tools (e.g., the BACnet protocol analyzer bacpypes, YABE, or Metasploit's BACnet scanner) to send Who-Is broadcast requests where Trane controllers respond with their device instance identifiers, model names, and firmware versions. Shodan and Censys can identify internet-exposed Trane controllers with searches like "TRANE" "Tracer" or port-based queries for port:47808.

Step 2 — Crafting the Malicious Payload (Weaponization): The attacker constructs a BACnet WriteProperty or proprietary Trane control request containing a crafted Application Layer (APDU) message. The critical manipulation is in a length/octet-count field: instead of a benign value (e.g., 0-500 bytes), the attacker sets a size field to 0xFFFFFFFF (4294967295 bytes) or another excessive value. Alternatively, for the HTTP management interface, the attacker may craft an HTTP request with an extremely large Content-Length header value.

For a BACnet-based attack:

BACnet/IP Header (UDP port 47808):
  - BVLC Type: 0x81
  - BVLC Function: 0x0A (Original-Unicast-NPDU)
  - BVLC Length: standard
APDU:
  - APDU Type: 0x00 (Confirmed Request)
  - PDU Type field, Service Choice: ReadProperty (0x0C)
  - Payload: Property Identifier set with malicious Length field

The attacker modifies the length octet within the property value encoding to 0xFFFFFFFF.

Step 3 — Execution (Trigger): The attacker sends the packet repeatedly using a scripted tool (Scapy, custom Python script, or modified BACnet test harness) to the device's IP address on UDP 47808. The initial request triggers the vulnerable memory allocation with the oversized value. The controller attempts to allocate >4GB of memory, immediately failing on typical embedded hardware with 256MB-1GB RAM. The allocation failure either causes an unhandled exception that crashes the process or the partial allocation consumes the heap until no memory remains for normal operations.

Step 4 — Post-Exploitation Impact: With the controller crashed, the building's HVAC system, lighting controls, and alarm monitoring cease to function. The controller may automatically reboot via a hardware watchdog, but the attacker simply re-sends the crafted packets in a loop (DoS script with 100ms interval). This creates a persistent denial-of-service condition where the controller cannot operate for more than a few seconds between reboots. For a facility operating as a data center, hospital, or pharmaceutical manufacturing plant, this can trigger equipment failure, environmental excursions, and regulatory violations.

Impact Assessment

The CVSS score is 8.7 (High severity) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, reflecting a network-reachable, unauthenticated attack with low complexity. The impact score focuses entirely on availability (A:H) with no confidentiality or integrity loss, meaning the attacker's objective is disruption rather than data theft or manipulation.

Critical impact characteristics:

• Availability Impact — High: Complete denial of service on the affected controller. The device becomes unable to perform normal building automation functions.
• Scope — Changed (S:C): The vulnerability impacts resources beyond the vulnerable component's security scope. A crashed Tracer controller affects the physical environment — temperature, humidity, ventilation — that depends on the automation system, effectively impacting the entire facility.
• Attack Complexity — Low: No special conditions or race conditions are required. The attacker does not need to be on a specific network segment.
• No Authentication: The attacker does not require credentials, making internet-exposed controllers immediately vulnerable.
• Blast Radius/Target Sector: Building automation systems controlling HVAC in commercial buildings, data centers, hospitals, universities, government facilities, and pharmaceutical cleanrooms. A successful DoS against critical infrastructure controllers interrupts building management, which could cascade to IT equipment overheating (data center), cold-chain failures (pharmaceuticals), or patient comfort/safety issues (hospitals).
• Lateral Movement Potential: While the CVE itself enables only DoS, compromised BACnet controllers are often used in OT networks as a pivot point. The attacker gains a foothold inside the industrial control system enclave, potentially enabling subsequent attacks on other BACnet devices or the underlying network.
• EPSS Probability: EPSS score of 0.00307 (23rd percentile) suggests this vulnerability is not currently being widely exploited in the wild, but public PoC/exploit availability increases the risk.

Detection Guidance

Sigma Rule

title: Trane Tracer Buffer Overflow Attempt - Excessive Length Field
id: 8f4c2e7a-9d31-4456-bc5a-2d55a81e03fc
status: experimental
description: Detects network packets targeting Trane Tracer SC controllers with excessive size/length fields indicating CVE-2026-28253 exploitation
author: Valtersit Threat Intel Team
date: 2026/03/01
logsource:
  category: network_connection
  product: zeek
  definition: 'Detects BACnet traffic or HTTP traffic to Trane Tracer controllers with excessive length fields'
detection:
  selection_bacnet:
    protocol: udp
    destination.port: 47808
    length:
      - '> 65535'
      - '> 1048576'
  selection_http:
    protocol: http
    destination.port:
      - 80
      - 443
    http.request.body_length:
      - '> 1000000'
    http.request.method: POST
  condition: selection_bacnet or selection_http
  timeframe: 1m
level: high
falsepositives:
  - Legitimate bulk file transfers to the controller (rare in OT networks)
  - Firmware update uploads if performed in-band (should be pre-scheduled)
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-28253

YARA Rule

rule CVE_2026_28253_Trane_Tracer_DOS {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious BACnet or Trane protocol packet patterns targeting memory allocation exhaustion vulnerability"
        cve = "CVE-2026-28253"
        date = "2026-03-01"
        severity = "high"
    strings:
        // BACnet APDU confirmed request patterns
        $apdu_confirmed_req = { 00 [0-5] 0C }
        // Oversized length encoding - (BACnet Unsigned int for length often 3-4 bytes)
        // Pattern for length field >= 0x1000000 (16MB or greater)
        $oversized_len_4byte = { 06 ?? ?? ?? [2-4] ?? ?? ?? ( 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 4A | 4B | 4C | 4D | 4E | 4F | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 5A | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 6A | 6B | 6C | 6D | 6E | 6F | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 7A ) }
        // Trane proprietary HTTP management endpoints
        $trane_http_path = "/tracer/" ascii nocase
        $trane_http_header = "Content-Length: 4" ascii nocase
        // Hexadecimal literal 0xFFFFFFFF (common excessive allocation size)
        $excessive_ff_ff = { FF FF FF FF }
    condition:
        uint16(0) == 0x810A or // BACnet BVLC Original-Unicast-NPDU
        (uint8(0) == 0x81 and uint8(1) == 0x0A) or
        ($apdu_confirmed_req and ($oversized_len_4byte or #excessive_ff_ff > 2)) or
        ($trane_http_path and $trane_http_header)
}

Suricata IDS Rule

alert udp any any -> any 47808 (msg:"ET TROJAN Trane Tracer SC CVE-2026-28253 Excessive Length Field Attempt"; flow:to_server; content:"|81 0a|"; depth:2; content:"|00 0c|"; within:10; pcre:"/[\x01-\x05]....[\x06\x07\x08\x09]....[\x7E-\xFF]/R"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:30028253; rev:1;)

alert http any any -> any any (msg:"ET SCAN Trane Tracer SC Excessive Content-Length DoS Attempt"; flow:to_server,established; http.method; content:"POST"; flowbits:set,trane_http; http.uri; content:"/tracer/"; nocase; http.request_line; pcre:"/^POST .*\/tracer\/.* HTTP\/1\.[01]\r\n/H"; http.header; pcre:"/Content-Length:\s*[0-9]{8,}/H"; threshold:type both, track by_src, count 3, seconds 30; classtype:attempted-dos; sid:30028254; rev:1;)

alert udp any any -> any 47808 (msg:"ET DOS Trane Tracer BACnet Huge Packet Size"; flow:to_server; content:"|81 0a|"; offset:0; content:"|00 0c|"; within:5; content:"|ff ff ff ff|"; within:30; threshold:type both, track by_src, count 3, seconds 15; classtype:attempted-dos; sid:30028255; rev:1;)

Elastic Detection

// Elastic EQL detection for CVE-2026-28253 Trane Tracer DoS
sequence by destination.ip, source.ip with maxspan=10s
  // Unexpected large BACnet packet
  [ network where
      network.protocol == "udp" and
      destination.port == 47808 and
      network.transport == "udp" and
      event.category == "network" and
      network.bytes > 500000
  ]
  // Followed by repeated similar large packets (sustained attack)
  [ network where
      network.protocol == "udp" and
      destination.port == 47808 and
      event.category == "network" and
      network.bytes > 200000
  ]
  // Controller responds or stops responding - ICMP unreachable or timeout
  [ network where
      event.category == "network" and
      (network.protocol == "icmp" or
       event.action == "network_traffic_dropped" or
       network.transport == "tcp" and destination.port == 443 and network.direction == "outbound")
  ]

Splunk SPL Query

# SPL Query to detect Trane Tracer CVE-2026-28253 exploitation attempts
index=netflow OR index=firewall sourcetype=netflow OR sourcetype=cisco:asa
( dest_port=47808 OR dest_port=443 OR dest_port=80 )
| eval is_suspicious = case(
    (dest_port == 47808 AND bytes_out > 500000), "BACnet_Huge_Packet",
    (dest_port == 443 AND bytes_out > 1000000 AND http_method == "POST"), "HTTP_Excessive_Content_Length",
    (dest_port == 47808 AND bytes_out > 200000), "BACnet_Repeated_Large_Packet"
  )
| where is_suspicious != NULL
| stats count as attempts, values(is_suspicious) as anomaly_type, 
        earliest(_time) as first_seen, latest(_time) as last_seen
        by src_ip, dest_ip, dest_port
| where attempts >= 5
| eval severe = if(attempts >= 20, "CRITICAL", "HIGH")
| table _time, src_ip, dest_ip, dest_port, anomaly_type, attempts, severe

Alternatively, for Zeek/Bro logs:

index=zeek sourcetype=bro:udp
dest_port=47808
| where len(payload) > 100000
| stats count as packet_count, avg(len(payload)) as avg_len, max(len(payload)) as max_len
        by src_ip, dest_ip
| where packet_count > 3
| table src_ip, dest_ip, packet_count, avg_len, max_len

Wazuh OSSEC Rule

<group name="trane, ot, dos, cve-2026-28253,">

    <rule id="100251" level="12">
        <field name="event_type">udp</field>
        <if_sid>100001</if_sid>
        <regex>dstport="47808"|dest_port="47808"</regex>
        <regex offset="0">len="[0-9]{6,}"|bytes="[0-9]{6,}"</regex>
        <description>Trane Tracer SC: Excessive UDP packet size to BACnet port 47808 - possible CVE-2026-28253 DoS attempt</description>
        <group>attack.impact,t1499.001,cve.2026-28253</group>
        <options>no_full_log</options>
    </rule>

    <rule id="100252" level="14">
        <field name="event_type">http</field>
        <regex>method="POST"|method="put"</regex>
        <regex>Content-Length:\s*[0-9]{8,}|content_length="[0-9]{8,}"</regex>
        <regex>/tracer/</regex>
        <description>Trane Tracer SC: HTTP request with excessive Content-Length targeting /tracer/ - CVE-2026-28253 exploit attempt</description>
        <group>attack.impact,t1499.001,cve.2026-28253</group>
        <options>no_full_log</options>
    </rule>

    <rule id="100253" level="10" frequency="5" timeframe="60">
        <if_matched_sid>100251</if_matched_sid>
        <description>Trane Tracer SC: Repeated excessive BACnet packets from same source - DoS attack in progress</description>
        <group>attack.impact,t1499.001,cve.2026-28253</group>
        <options>no_full_log</options>
    </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The vendor (Trane) has released Tracer SC+ v6.30.2313 which is claimed to address this vulnerability. However, this patch has not been independently verified and the patched version applies only to Tracer SC+; no patch has been listed for Tracer SC or Tracer Concierge at this time.

1. Immediate Mitigations (before patching):

   • Segment the network: Isolate all Trane Tracer SC, SC+, and Concierge controllers onto a dedicated VLAN or OT network segment with strict firewall rules. Restrict inbound access from the enterprise network and the internet.
   • Disable/restrict management interfaces: If the web management interface (HTTPS on the controller) is not actively used, disable it via the controller's local configuration. At minimum, restrict access via IP allow-list.
   • Filter BACnet traffic: Configure perimeter firewalls to allow BACnet/IP (UDP 47808) only from authorized building management system (BMS) workstations and supervisory controllers. Block all other sources.
   • Deploy an IDS/IPS: Place Suricata or similar inline detection at the network boundary facing the controllers. Use the rules provided in the Detection Guidance section to block or alert on oversized BACnet packets.
   • Monitor for anomalous traffic: Implement the Sigma/Splunk/Elastic detections to alert on unusual packet sizes targeting BACnet ports.

2. Patch/Upgrade Steps:

   • Tracer SC+: Upgrade to version v6.30.2313 (or later) as released by Trane. Verify the download from Trane's official support portal and validate the firmware checksum.
   • Tracer SC and Tracer Concierge: Contact Trane technical support to determine the patch status for these models. As of this report, no patched version has been publicly confirmed. Request CVE-2026-28253 mitigation guidance directly from Trane.
   • Post-patch validation: After upgrading, re-verify that the firmware version is correctly installed and re-test the controller's network exposure. Re-run the detection rules to confirm no residual exploitation attempts.

3. Long-Term Hardening:

   • Apply the principle of least privilege: Ensure no device on the BACnet segment has unrestricted access to the Trane controllers. Use 802.1X or MAC-based access control for network-level enforcement.
   • Network monitoring, continuously: Deploy the provided detection rules to continuously monitor for exploitation attempts. Maintain logs for at least 12 months for forensic analysis.
   • Develop a patch testing cycle: Establish a process to test and deploy firmware updates to all BMS controllers within 30 days of vendor release.
   • Reference the CISA KEV catalog: While this CVE is not currently in CISA's Known Exploited Vulnerabilities catalog, re-check cisa.gov/KEV every 7 days as it may be added if in-the-wild exploitation is observed.
   • Adopt a secure-by-design approach: When procuring new BMS equipment, require vendors to provide SBOMs (Software Bills of Materials), security advisories, and firmware update commitments in procurement contracts.

References

1. NVD Entry: CVE-2026-28253 — https://nvd.nist.gov/vuln/detail/CVE-2026-28253
2. CISA ICS-CERT Advisory: CVE-2026-28253 Trane Tracer SC, Tracer SC+, and Tracer Concierge — https://www.cisa.gov/news-events/ics-advisories/icsa-26-xxx-xx
3. Trane Product Security Advisory: Tracer SC+ v6.30.2313 Release Notes — https://www.trane.com/commercial/north-america/us/en/software-systems/tracer-sc.html
4. NVD CWE Entry CWE-400: Uncontrolled Resource Consumption — https://cwe.mitre.org/data/definitions/400.html
5. FIRST EPSS Score for CVE-2026-28253 — https://www.first.org/epss/api (query by CVE ID)

Threat Actor Campaigns: As of the report date, there are no documented threat actor campaigns specifically targeting this vulnerability. The EPSS percentile (23%) indicates low current exploitation. However, the public availability of PoC/exploit code means that opportunistic attackers and commodity botnets may begin scanning for vulnerable Trane controllers. Monitoring of public exploit databases (Exploit-DB, Packet Storm) is advised for active PoC releases. Note that building automation systems have been historically targeted by actors such as APT28, Dragonfly/Havex, and ransomware groups like REvil to disrupt critical infrastructure — the availability of a new unauthenticated DoS vector warrants elevated attention in critical infrastructure environments.