CVE-2021-38450

Published: Oct 27, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected (6)

Products: Trane: Tracer Concierge, Tracer Sc+ Firmware

Trane

2 products

Tracer Concierge

Tracer Sc+ Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Trane Tracer Concierge	Before 5.5
Trane Tracer Concierge	Version 5.5

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Trane Tracer Sc Firmware	Before 4.4
Trane Tracer Sc Firmware	Version 4.4

Running on/with	Platform Versions
Trane Tracer Sc	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Trane Tracer Sc+ Firmware	Before 5.5
Trane Tracer Sc+ Firmware	Version 5.5

Running on/with	Platform Versions
Trane Tracer Sc+	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://us-cert.cisa.gov/ics/advisories/icsa-21-266-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-21-266-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.