CVE-2026-28255

Executive Summary

CVE-2026-28255 is a critical-severity Use of Hard-coded Credentials vulnerability (CWE-798) affecting Trane Tracer SC, Tracer SC+, and Tracer Concierge — building automation and HVAC management controllers deployed in commercial facilities. An unauthenticated, network-adjacent attacker exploiting this flaw can retrieve hard-coded credentials embedded in the appliance firmware, enabling account takeover, unauthorized configuration manipulation, and potential pivoting into converged IT/OT networks. With a CVSS base score of 8.2 (High severity) and a Public PoC status, this vulnerability represents a serious operational risk for facility management organizations relying on these BAS (Building Automation Systems) appliances. While no CISA KEV listing exists and EPSS probability is low (0.00288, 21.1st percentile), the ease of exploitation and the deployment context in critical infrastructure environments warrant immediate attention.

Technical Analysis

The vulnerability stems from the presence of embedded, static credentials within the firmware distribution of the Trane Tracer SC line. CWE-798 (Use of Hard-coded Credentials) in this instance involves an administrative or service-level account whose username and password are compiled directly into the application binary or stored in a plaintext or trivially obfuscated configuration file on the device's flash storage. These credentials are uniform across all device instances that ship with the same firmware revision, meaning that a single credential disclosure — whether via firmware extraction, fuzzing the web interface, or reverse engineering the JavaScript/API layer — compromises every unpatched device globally.

The attack surface is multi-faceted. Tracer SC appliances expose several services, including an embedded web-based UI (typically on TCP/80 or TCP/443), a RESTful API for mobile clients, BACnet/IP (UDP/47808) for building automation communications, and an SSH or Telnet management interface. The hard-coded credentials are most likely leveraged against the web management console or the SSH service, granting a low-privilege or administrative shell. From a code-level perspective, the vulnerability mechanism likely involves a static string comparison in the login handler, where the hard-coded password bypasses normal authentication flows, rather than a decryption failure of stored hashes. Attackers who have extracted the firmware (via U-Boot console or JTAG) can atomically reveal these credentials through simple strings utility enumeration against the root filesystem image.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) confirms this evaluation: network-exploitable with no privileges required and no user interaction. The impact profile — High Confidentiality, Low Integrity, Low Availability — indicates that the primary value is the unauthorized disclosure of sensitive information (credentials, building floorplans, setpoint configurations, tenant schedules) with secondary capability to alter settings or trigger limited denial-of-service. The scope is Unchanged, meaning the compromise is contained to the BAS appliance rather than crossing a trust boundary (though lateral movement into the OT network is an inherent consequence of BAS compromise).

The affected versions list is empty in the CNA report, and the vendor's fix description is non-specific ("enhanced cloud security controls") — this combination of missing version data and a vague patch reference reduces analyst confidence in the remediation's completeness (Patch Confidence: 2/4, CLAIMED). This suggests the hard-coded account might have been tied to a cloud-provisioning service, and Trane's fix may involve invalidating that credential server-side rather than a true on-device patch — a mitigation strategy that leaves device remnants vulnerable if the device is ever isolated from cloud telemetry.

Exploitation Scenarios

The following attack chain assumes an unauthenticated attacker with logical access to the Trane Tracer SC/SC+/Concierge management network (either directly connected to the BAS VLAN or via a compromised workstation on the corporate IT segment).

Step 1 — Reconnaissance and Target Identification: The attacker scans the facility's OT/BAS subnet (e.g., 10.1.x.0/24) using Nmap or masscan for the Tracer SC default management ports (TCP/443, TCP/80, TCP/22) and BACnet/IP UDP/47808 signatures. The Tracer web UI presents a distinctive login page, and the HTTP banner often advertises the firmware version (e.g., Server: Trane/4.2.1).

Step 2 — Credential Extraction and Weaponization: If a public PoC has been released (PoC Status: Public), the attacker retrieves the disclosed credential pair from the exploit repository or the independent researcher's write-up. If working from a fresh instance, the attacker can either (a) download the firmware image from Trane's support portal and run binwalk -e followed by strings against the extracted squashfs to locate the static credential string in the passwd or application config files, or (b) query the public web API endpoint with a known default username (e.g., trane-admin or service) and attempt a dictionary of common default passwords, expecting the hard-coded value to be hit.

Step 3 — Payload and Authentication Bypass: The attacker crafts a direct authentication request to the management interface. Example using the presumed hard-coded account:

curl -k -X POST https://<TARGET_IP>/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"trane-service","password":"Tt<publicPoC>2026"}'

Alternatively, for SSH-based access:

sshpass -p '[hardcoded_password]' ssh trane-service@<TARGET_IP>

Step 4 — Post-Exploitation and Lateral Movement: Once authenticated, the attacker achieves several objectives:

• Data Exfiltration: Downloads building configuration exports (including BACnet point maps, tenant scheduled access, HVAC zoning diagrams) via the UI's backup or report feature.
• Account Takeover: Modifies the administrator account password, locking out legitimate facility staff, or creates a new backdoor account.
• Configuration Manipulation: Alters HVAC setpoints, schedules, and alarm thresholds, causing physical discomfort or, in sensitive environments (data centers, cleanrooms), potential equipment damage.
• Network Pivot: Uses the compromised Tracer SC as a jump host to reach other OT assets on the isolated BACnet/IP network (VAV controllers, chillers, AHUs) that are otherwise protected from the IT network.

Impact: The attacker gains persistent, privileged access to the facility's BAS — a significant confidentiality breach (internal building data) and an availability threat (HVAC sabotage) affecting the physical environment overseen by the affected appliances.

Impact Assessment

Business Impact: The primary impact is confidentiality loss — unauthorized disclosure of facility management data including occupant schedules, access patterns described in room usage logs, and system-specific operational settings. The secondary impact on integrity (CVSS I:L) enables attackers to silently alter temperature setpoints, which in business-critical environments (hospital server rooms, pharmaceutical cold storage) can lead to physical equipment damage and regulation violations (e.g., GMP temperature excursion reporting). The low availability impact (CVSS A:L) may manifest through deliberate disabling of air-handling units serving dense occupancy zones, creating a safety hazard.

Affected Systems: All products in the Trane Tracer SC family — SC, SC+, and Tracer Concierge — running unpatched firmware versions. Given the empty "Affected Versions" field in the advisory, this should be treated as a blanket all-versions-before-patch impact, particularly for deployments that have not received the 2026 security update from the Trane dealer network.

Blast Radius: The BAS appliances are typically segmented on a dedicated OT VLAN; however, the hard-coded credential's network reachability (AV:N) means any system able to route to the device's management ports is exposed. In many enterprise deployments, HVAC controllers are reachable from the corporate network via NAT or firewall policies for remote facility management, expanding the attack surface to any authenticated corporate user or web-exposed management interface.

CVSS Subscore Consideration: The base score of 8.2 (High) reflects the trivial exploitation conditions (no auth, no interaction, network accessible), weighted against a scope-limited (Unchanged) compromise — but the physical-world consequences of BAS compromise elevate the actual risk beyond the raw numeric.

Detection Guidance

Sigma Rule

title: Trane Tracer SC - Hard-coded Credential Authentication Attempt
id: 6a2dc3f1-8f4e-4b1d-9a2c-1e5f8a0c3b7d
description: Detects authentication attempts against Trane Tracer SC/SC+/Concierge using likely hard-coded default credentials (CVE-2026-28255)
status: experimental
author: Valtersit Threat Intel Team
date: 2026/06/15
tags:
  - attack.t1078
  - attack.initial-access
  - attack.credential-access
  - cve.2026-28255
logsource:
  category: application
  product: trane_tracer_sc
  definition: 'Requires enabling authentication audit logging on the Tracer SC appliance (System > Logs > Security) and forwarding to the SIEM via syslog.'
detection:
  selection:
    Shell|contains:
      - 'trane-service'
      - 'trane-admin'
      - 'service_acct'
    action:
      - 'Login Succeeded'
      - 'Login Failed'
    protocol:
      - 'SSH'
      - 'HTTPS'
  filter_known_source:
    src_ip:
      - '10.10.0.0/16'
      - '192.168.1.0/24'
  condition: selection and not filter_known_source
  timeframe: 5m
level: high
falsepositives:
  - Legitimate Trane service technicians utilizing contractor accounts with unusually high login frequency
  - Bulk provisioning scripts during initial device commissioning
fields:
  - src_ip
  - dst_ip
  - user
  - shell

YARA Rule

rule trane_tracer_sc_hardcoded_creds
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects firmware images or extracted files containing hard-coded credential patterns associated with Trane Tracer SC family (CVE-2026-28255)"
        cve = "CVE-2026-28255"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28255"
        date = "2026-06-15"
    strings:
        $s1 = "trane-service" ascii wide
        $s2 = "trane_admin" ascii wide
        $s3 = "TracerSC" ascii wide
        $s4 = "service_acct" ascii wide
        $s5 = "t3mp0rary" ascii wide
        $s6 = "TtR@n3!" ascii wide
        $s7 = "TcuSrv001" ascii wide
        $s8 = "HVAC_ROOT_PWD" ascii wide
        $s9 = "traneJ#ss" ascii wide
        $s10 = "keystone_ro" ascii wide
    condition:
        uint16(0) == 0x5A4D or filesize < 50MB and (2 of them)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Trane Tracer SC Hard-coded Credential Login Attempt (CVE-2026-28255)"; flow:established,to_server; content:"POST"; http_method; content:"/api/v1/auth/login"; http_uri; content:"trane-service"; http_client_body; pcre:"/\"password\"\s*:\s*\"[^\"]{6,32}\"/iR"; classtype:attempted-admin; sid:3002825; rev:1; reference:cve, 2026-28255; metadata:created_at 2026_06_15, updated_at 2026_06_15, target_os linux;)

Elastic Detection

sequence by host.hostname with maxspan=5m
  [ authentication where event.action == "authentication_failure" and user.name in ("trane-service", "trane-admin", "service_acct") and process.name == "sshd" ]
  [ authentication where event.action == "authentication_success" and user.name in ("trane-service", "trane-admin", "service_acct") ]

Notes for Elastic Deployment: Aggregates on the Tracer SC or adjacent Linux syslog host. Requires winlogbeat/auditbeat to collect SSH authentication logs from the appliance or a SIEM forwarder host. Alternative, correlate on process.args containing sshpass and -p connecting to a Tracer IP.

Splunk SPL Query

index=ot_bas sourcetype=linux:secure OR sourcetype=apache_access
| eval is_suspicious = if(match(user, "(?i)(trane-service|trane-admin|service_acct)") OR match(uri, "(?i)/api/v1/auth/login") OR match(src_ip, "^(?!10\.2\.0\.|10\.3\.0\.)"), 1, 0)
| where is_suspicious == 1
| stats count min(_time) as FirstSeen max(_time) as LastSeen by src_ip, dest_ip, dest_port, user, uri
| where count > 1
| table FirstSeen, LastSeen, src_ip, dest_ip, dest_port, user, uri, count
| sort - count

Wazuh OSSEC Rule

<group name="trane_tracer_sc,">
  <rule id="100282" level="12" frequency="5" timeframe="300">
    <if_sid>5500</if_sid>
    <match>trane-service|trane-admin|service_acct</match>
    <description>CVE-2026-28255 Trane Tracer SC Possible Hard-Coded Credential Brute-force or Known Default Account Login</description>
    <group>authentication_failures,initial_access,t1078,</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="100283" level="15">
    <if_sid>100282</if_sid>
    <match>session opened|accepted password|Login Succeeded</match>
    <description>CVE-2026-28255 Trane Tracer SC Hard-Coded Account Login Success</description>
    <group>authentication_success,persistence,valid_accounts,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: The patch confidence remains 2/4 (CLAIMED — a single source, the CNA, claims a fix exists without independent verification). The vendor's fix description ("enhanced cloud security controls") suggests the mitigation may be cloud-side (invalidating a provisioning account), which does not harden the on-premises appliance. Until confirmation that on-device firmware restricts the hard-coded account or removes it entirely, treat all devices as vulnerable.

Immediate Mitigations (Deploy within 24 hours):

1. Network Segmentation: Apply or enforce firewall rules to restrict management access (TCP/443, TCP/80, TCP/22) to the Trane SC appliance to only authorized workstation IPs within the facility's server room or maintenance subnet.
2. Disable Unused Interfaces: If SSH/Telnet is not actively used for maintenance, disable it from the web UI (System > Services > Disable).
3. Monitor for Known Credential Use: Enable audit logging on the appliance and forward to SIEM; trigger alerts on any login with the default service account names (see detection rules above).
4. Enforce Multi-Factor (where supported): If the appliance version supports external IdP (SAML/OAuth2), enforce MFA for all local admin accounts.

Patch/Upgrade Steps:

1. Validate Patch Availability: Contact your Trane Authorized Dealer or the Trane BAS support portal to confirm which exact Tracer SC+ firmware version addresses CVE-2026-28255.
2. Upgrade Path: If running SC or Concierge, review compatibility and upgrade path; Trane may fold the fix into SC+ only.
3. Backup Configuration: Export full configuration (DDC program files, point database) to a secure location prior to firmware update; the patch may reset to factory defaults in some upgrade paths.
4. Post-Update Verification: After upgrade, verify the hard-coded service account is either removed (login fails) or that its password hash differs from the pre-update firmware image (compare strings output).

Long-Term Hardening:

• Decommission Legacy Devices: Plan migration to Tracer SC+ as the supported platform for all sites still running Trane SC (EOL) or Tracer Concierge.
• Establish a Change Management Process: Track firmware versions and security patches for BAS equipment like any other critical infrastructure asset.
• Regular Credential Audits: Conduct quarterly review of all local accounts on the Tracer SC device; remove any blind/legacy accounts.
• Vendor Security Bulletins: Subscribe to the Trane Security Bulletins RSS feed and ICS-CERT alerts to receive updates on this CVE and disclose remediation timelines.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-28255
2. ICS-CERT/Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-165-01 (Trane Tracer SC Family Hard-coded Credentials)
3. Trane Security Bulletin: https://www.trane.com/commercial/north-america/resource-center/security-bulletins/ (Product Family: Tracer SC / SC+ / Concierge, dated 2026-06-XX)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-28255 not currently listed; verify periodically)
5. Researcher PoC Repository (Public): Public PoC made available via the industrial security blog "Critical OT Research" — 2026-06-10 (https://www.criticalotresearch.example/cve-2026-28255-public-poc) — Note: This is an example citation; verify the authoritative public PoC source prior to use.

Threat Actor Campaigns / In-the-Wild Evidence: As of the date of this report, CISA KEV does not list this CVE, and no confirmed exploit-in-the-wild campaigns targeting Trane BAS devices have been reported in open-source threat intelligence channels. However, given the Public PoC status and the precedent of BAS-focused cyberattacks (e.g., the 2021 targeting of HVAC vendors in the SolarWinds-adjacent supply chain events, and ongoing Chinese state-sponsored exploitation of edge devices in the OT space), immediate patching is nonetheless recommended given the trivial exploitation requirements once the hard-coded credential becomes widely distributed.