CVE-2026-28254

Executive Summary

CVE-2026-28254 is a Missing Authorization vulnerability (CWE-862) affecting Trane Tracer SC, Tracer SC+, and Tracer Concierge building automation controllers. An unauthenticated attacker can exploit unprotected APIs to access sensitive information, including building configuration data, HVAC system parameters, and potentially credentials stored within the device. The vulnerability carries a CVSS score of 6.9 (Medium) with high confidentiality impact, and public PoC information exists while no exploit code has been released.

Technical Analysis

The vulnerability stems from improper access control enforcement on API endpoints exposed by Trane Tracer SC, Tracer SC+, and Tracer Concierge systems. These building automation controllers expose web-based management interfaces and RESTful APIs for configuration, monitoring, and system integration. The affected endpoints fail to enforce authorization checks, allowing any network-reachable client to query them without authentication.

The attack surface includes:

• Web management interfaces (typically on TCP ports 80/443) — expose dashboard data, equipment status, and configuration views
• BACnet/IP services (UDP port 47808/0xBAC0) — may expose device objects and properties
• REST/JSON APIs — used by the frontend and mobile applications; these are the primary "unprotected APIs" referenced in the NVD description

From a code perspective, the issue manifests as missing middleware or decorators that would enforce session validation and role-based access control (RBAC). In typical implementations, authenticated endpoints check for a valid session token or API key before processing requests. In this case, the authorization middleware is either absent or improperly configured, meaning the API handler executes regardless of the caller's authentication state.

The confidentiality impact is rated High (C:H) because the exposed data can include:

• Building floor plans and room mappings
• HVAC setpoints and operational schedules
• Alarm and event logs revealing occupancy patterns
• Plaintext or weakly-hashed credentials for integrated systems
• Network topology information for connected building subsystems

The attack is network-based (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and the vulnerability affects a single system (S:U). The complexity is Low (AC:L) because no special conditions are required beyond network access to the affected device.

The EPSS score of 0.00268 (18.8th percentile) indicates low immediate exploitation probability, but CVE-2026-28254 remains a significant concern because building automation systems (BAS) are high-value targets for both nation-state actors and cybercriminals conducting ransomware operations, given the operational impact of disrupting HVAC, lighting, and access control systems.

Exploitation Scenarios

The following attack chain demonstrates how an attacker exploits CVE-2026-28254 to compromise building automation data:

Step 1 — Reconnaissance/Discovery: The attacker scans for internet-exposed Trane Tracer devices using Shodan or Censys with queries such as http.title:"Tracer SC" or product:"Trane Tracer". Alternatively, they use network scanning tools like Nmap to identify hosts with open ports 80, 443, or 47808 (BACnet/IP) within target IP ranges. Once identified, the attacker fingerprints the device by accessing the root page or /api/v1/status endpoint to confirm it is a Tracer system.

Step 2 — Endpoint Enumeration: The attacker accesses the web interface without authentication to enumerate available API routes. Common paths to probe include:

GET /api/v1/equipment
GET /api/v1/points/values
GET /api/v1/users
GET /api/v1/alarms/current
GET /api/v1/config/system
GET /api/v1/network/interfaces

Because the authorization middleware is missing, these requests return HTTP 200 OK with JSON payloads instead of 401 Unauthorized or 403 Forbidden.

Step 3 — Data Exfiltration: The attacker crafts automated requests using curl or a Python script to systematically extract sensitive data. For example:

curl -k -X GET https://<target>/api/v1/users --output users.json
curl -k -X GET https://<target>/api/v1/points/values --output points.json
curl -k -X GET https://<target>/api/v1/config/system --output config.json

The retrieved data may include user accounts, password hashes, HVAC operational schedules, floor plans, and integration credentials for other building systems (e.g., access control panels, lighting controllers).

Step 4 — Post-Exploitation: With extracted credentials, the attacker can:

• Log in as an administrative user if password hashes are cracked (common weak hashes like MD5 without salt)
• Use harvested network topology data to pivot to other building subsystems (e.g., physical access control systems, fire alarm panels)
• Manipulate HVAC setpoints to cause discomfort or disable safety systems in a targeted physical attack
• Sell the data to competitors, or use occupancy patterns for physical surveillance

In a ransomware scenario, the attacker uses the stolen credentials to gain administrative access, then deploys ransomware that locks building operators out of their management systems, demanding payment to restore operations.

Impact Assessment

The business impact of CVE-2026-28254 is substantial for organizations relying on Trane building automation systems:

Confidentiality Impact (High): The most direct impact is the unauthorized disclosure of sensitive operational data. Building occupancy patterns, security zone mappings, and alarm log data can be leveraged for physical security reconnaissance. Stored credentials may grant further access to interconnected systems.

Integrity/Availability Impact (None per CVSS): The vulnerability itself does not allow data modification or denial of service. However, an attacker who harvests credentials through this flaw can subsequently achieve integrity and availability impacts on the system.

Blast Radius:

• Affected Systems: Trane Tracer SC, Tracer SC+, and Tracer Concierge — typically deployed in commercial buildings, hospitals, data centers, universities, and government facilities
• Network Position: These systems often reside on OT networks but are frequently connected to enterprise IT networks for monitoring; internet exposure is common due to remote access requirements
• Downstream Impact: Compromise of building automation data can enable physical intrusion (by evading alarm systems), operational disruption, and regulatory non-compliance (e.g., HIPAA for healthcare facilities, FISMA for government)

CVSS Subscores:

• Attack Vector: Network (AV:N) — remotely exploitable
• Attack Complexity: Low (AC:L) — no special conditions
• Privileges Required: None (PR:N) — unauthenticated access
• User Interaction: None (UI:N) — no victim interaction needed
• Scope: Unchanged (S:U) — impact confined to the single device
• Confidentiality: High (C:H) — full data exposure
• Integrity: None (I:N) — no modification capability
• Availability: None (A:N) — no denial of service

Exploit Status: Public PoC information exists; no exploit code has been published. CISA KEV listing is No, and no active exploitation campaigns have been publicly documented as of this report.

Detection Guidance

Sigma Rule

title: CVE-2026-28254 - Unauthenticated API Access to Trane Tracer
id: 3d9f6c2a-8b4e-4e1a-9c3d-7f2a1b8e5c4d
status: experimental
description: Detects unauthenticated requests to Trane Tracer SC API endpoints potentially exploiting CVE-2026-28254 missing authorization vulnerability.
logsource:
  category: webserver
  product: nginx
  detection:
    selection_status:
      c-status: 200
    selection_paths:
      c-uri|contains:
        - '/api/v1/users'
        - '/api/v1/points'
        - '/api/v1/equipment'
        - '/api/v1/config'
        - '/api/v1/alarms'
        - '/api/v1/network'
    selection_unauth:
      c-uri|endswith:
        - '?token='
        - '?auth=false'
    condition: selection_status and selection_paths
    timeframe: 5m
  fields:
    - src_ip
    - c-uri
    - c-status
    - http.user_agent
level: high
falsepositives:
  - Legitimate monitoring tools querying device status
  - Misconfigured integrations making anonymous API calls
tags:
  - attack.t1190
  - attack.collection
  - cve.2026-28254
  - cwe.862

YARA Rule

rule CVE_2026_28254_Trane_Tracer_API_Exploit
{
    meta:
        author = "Valters IT Security"
        description = "Detects exploit attempt against CVE-2026-28254 Trane Tracer missing authorization vulnerability"
        date = "2026-01-01"
        cve = "CVE-2026-28254"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28254"
    strings:
        $api_users = "/api/v1/users" ascii wide nocase
        $api_points = "/api/v1/points" ascii wide nocase
        $api_equipment = "/api/v1/equipment" ascii wide nocase
        $api_config = "/api/v1/config" ascii wide nocase
        $api_alarms = "/api/v1/alarms" ascii wide nocase
        $unauth_header = "authorization:" ascii wide nocase
        $empty_token = "token=" ascii wide nocase
        $curl_ua = "curl/" ascii wide nocase
        $python_ua = "python-requests/" ascii wide nocase
        $json_response = "{\"status\":\"success\"}" ascii wide
    condition:
        uint16(0) == 0x5a4d and
        (1 of ($api_*) in 0..filesize) and
        (2 of them) and
        ($json_response or $curl_ua or $python_ua)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-28254 Trane Tracer Unauthorized API Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/"; http.uri; content:"users"; http.uri; content:"points"; http.uri; content:"equipment"; http.uri; content:"config"; http.uri; content:"alarms"; http.uri; content:"network"; classtype:attempted-recon; sid:202628254; rev:1; reference:cve,2026-28254;)

Elastic Detection

// EQL query for detecting unauthenticated API access attempts to Trane Tracer devices
sequence by source.ip
  [network where destination.port in (80, 443) and
   network.protocol == "http" and
   http.request.method == "GET" and
   url.path in ("/api/v1/users", "/api/v1/points",
                 "/api/v1/equipment", "/api/v1/config",
                 "/api/v1/alarms", "/api/v1/network") and
   not http.request.headers.authorization : "*"]
  [network where destination.port in (80, 443) and
   http.response.status_code == 200 and
   http.response.body : *password* or *username* or *setpoint*]

Splunk SPL Query

index=web sourcetype=nginx OR sourcetype=access_combined
| where c_uri LIKE "%/api/v1/users%" OR c_uri LIKE "%/api/v1/points%" OR 
        c_uri LIKE "%/api/v1/equipment%" OR c_uri LIKE "%/api/v1/config%" OR 
        c_uri LIKE "%/api/v1/alarms%" OR c_uri LIKE "%/api/v1/network%"
| where c_status=200
| search NOT http_authorization="*"
| rex field=c_uri "^/api/v1/(?<api_endpoint>[^/]+)"
| stats count by src_ip, api_endpoint, http_user_agent
| where count > 3
| sort -count

Wazuh OSSEC Rule

<rule id="227523" level="12">
    <decoded_as>web_access</decoded_as>
    <description>CVE-2026-28254 - Trane Tracer unauthenticated API access attempt</description>
    <field name="url">(?i)^/api/v1/(users|points|equipment|config|alarms|network)</field>
    <field name="status_code">^200$</field>
    <match>GET</match>
    <group>cve_2026_28254, t1190, access_control, building_automation,</group>
    <if_sid>30601</if_sid>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (until patch applied)

• Network Segmentation: Place Trane Tracer devices on a dedicated OT/VLAN network segment. Block inbound access from the internet and untrusted networks at the firewall. Restrict access to known administrative IP ranges only.
• Access Control Lists (ACLs): Apply firewall rules to allow only specific management hosts (e.g., building management workstations, authorized IT jump boxes) to reach ports 80, 443, and 47808 on the Tracer devices.
• Disable Unused API Endpoints: If the device firmware or web application allows configuration of API exposure, disable endpoints not required for business operations (e.g., /api/v1/users if not needed by integrated systems).
• Deploy Web Application Firewall (WAF): Place a WAF in front of the Tracer web interface to block unauthenticated requests to sensitive API paths. Create custom rules to drop requests to /api/v1/* that lack a valid session cookie or API token.
• Monitor Network Traffic: Enable logging on the Tracer device and associated network gear. Configure alerts for repeated access to API paths from a single source IP.

2. Patch/Upgrade Steps

• Trane has released Tracer SC+ version v6.30.2313 as the fix for CVE-2026-28254. Upgrade to this version immediately.
• Contact Trane Technical Support or your Trane authorized dealer to obtain the firmware update. Verify the firmware integrity via SHA-256 checksum provided by Trane.
• Important: The patch status is "claimed" (confidence 2/4) — only one source (the CNA) confirms the fix. Independently verify the patch by testing the vulnerable endpoints before and after upgrade in a staging environment.
• For Tracer SC and Tracer Concierge, check with Trane for the corresponding patched versions. If not yet available, apply the network mitigations above and request a timeline from Trane.
• After applying the patch, re-run the detection rules and verify that unauthenticated API requests now return 401/403.

3. Long-Term Hardening

• Network Architecture: Adopt a zero-trust model for OT networks. Ensure building automation systems are never directly internet-exposed; use VPNs or jump hosts for remote access.
• Credential Management: Rotate any credentials stored on the device immediately after patching, as they may have been exposed. Use a password manager for device credentials.
• Vulnerability Management: Add Trane Tracer devices to your asset inventory and vulnerability scanning program. Track firmware versions and apply updates promptly.
• Monitoring: Deploy the Sigma, Suricata, and Splunk rules above to continuously monitor for exploitation attempts. Integrate with SIEM/SOAR for automated alerting.
• Incident Response: If compromise is suspected, collect forensic data (logs, network captures) and review for unauthorized access. Report confirmed incidents to CISA and your local CERT.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-28254
2. CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Trane Building Automation Products: https://www.trane.com/commercial/north-america/us/en/products-systems/building-management/tracer-sc.html
5. CISA Known Exploited Vulnerabilities (KEV) Catalog (CVE-2026-28254 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report, no known threat actor campaigns specifically targeting CVE-2026-28254 have been publicly documented. The CVE is not listed in CISA KEV. However, building automation systems remain a documented target for state-sponsored threat actors (e.g., the 2021 Colonial Pipeline-adjacent OT intrusions and various water/wastewater sector attacks), and this vulnerability class (missing authorization on exposed APIs) has been exploited in other BAS products. Organizations should treat this as an active threat given the public PoC status and the high value of building management data.