June 28, 2026 • Vulnerability Research, Building Automation
TL;DR
Claroty’s Team82 found five vulnerabilities in the Trane Tracer SC+ HVAC controller — the device that keeps data center cooling systems running. The worst of the chain (CVE-2026-28252) lets an attacker bypass SSH authentication and land a root shell using nothing but a broken substitution cipher. Combined with hardcoded encryption keys and unauthenticated API endpoints, the full chain gives remote attackers complete control over building management systems that directly regulate physical temperature in data centers, hospitals, and commercial buildings.
Trane released firmware v6.30.2313 to address all five issues. If your facility runs Tracer SC+ at version v6.2 or below, patch now.
Why HVAC Controllers Are High-Value Targets
A data center without cooling is a data center on a countdown. Servers generate enormous heat. When cooling fails, thermal protection triggers within minutes — hardware shuts down, services drop, and depending on the facility, millions of dollars in SLA violations start accumulating.
The Trane Tracer SC+ sits at the center of that cooling infrastructure. It coordinates temperature setpoints, fan speeds, chilled water valves, and air handling units across a building or campus. It communicates with downstream devices over BACnet (the standard protocol for building automation) and integrates with centralized building management systems.
This is not an IT device. It is a cyber-physical controller with direct authority over the thermal environment of critical facilities. Compromising it gives an attacker the ability to raise temperatures, disable alarms, or shut down cooling entirely.
The Vulnerabilities: A Five-Link Chain
Team82 researcher Amir Zaltzman identified five distinct flaws in the Tracer SC+ firmware (versions up to v6.2). Individually, several are medium-severity. Chained together, they provide unauthenticated remote code execution with root privileges.
CVE-2026-28252 — Authentication Bypass via Broken Crypto (CVSS 8.1)
The Tracer SC+ includes a Trane Diagnostic Service that provides SSH access for authorized maintenance. It uses a challenge-response mechanism: the device presents a random GUID, and the user must supply the correct response to authenticate.
The problem: the response algorithm is a deterministic substitution cipher using two hardcoded arrays. Anyone who reverse-engineers the PAM module (pam_TraneAuthenticate.so) can calculate the correct response for any challenge without knowing any secret.
The algorithm:
response[0] = keypad[search.find(challenge[0])]
response[i] = keypad[(search.find(challenge[i]) - search.find(challenge[i-1])) % 31]Where search and keypad are hardcoded character arrays baked into the firmware. No private key. No shared secret. The authentication is purely decorative.
Impact: Root-level SSH access to the controller. Full control of HVAC operations, configuration, and connected devices.
Prerequisite: The SSH Diagnostic Service must be manually enabled (it is disabled by default).
CVE-2026-28253 — Pre-Auth Denial of Service (CVSS 7.5)
The main server binary (HydraMain) handles HTTP and BACnet connections. Its HTTP header parser (TEvoHttpReceiver::recvLine) reads incoming data one byte at a time, allocating progressively larger buffers until it finds a newline character.
There is no maximum header size. An attacker can send approximately 2GB of data without newline characters, causing the allocator to request an impossibly large buffer. The operator.new[] call throws SIGABORT, crashing the entire service — including both the web interface and all BACnet communications.
Impact: Complete loss of the management interface and BACnet protocol handling. Downstream HVAC equipment loses its coordinator.
Prerequisite: Network access to the web server port. No authentication required.
CVE-2026-28254 — Unauthenticated Information Disclosure (CVSS 5.8)
Multiple API routes on the Tracer SC+ web server require no authentication:
/evox/tis/websocketTunnelStatus— reveals whether the device connects to Trane’s cloud/evox/bacnet/report— dumps the full BACnet device report (every connected controller, sensor, and actuator)/uidata/hui/NavTreeData.hui— leaks cached GUI assets including floor plans and facility images
Impact: An attacker can map the entire building automation network, identify connected controllers, enumerate HVAC zones, and identify high-value targets — all without credentials.
CVE-2026-28255 — Hardcoded Global Credentials (CVSS 6.8)
A configuration file on the Tracer SC+ filesystem contains encrypted credentials for multiple Trane remote services. These credentials are identical across all deployed devices worldwide.
The encryption key used to protect them is itself hardcoded (see CVE-2026-28256). Once decrypted, the plaintext credentials provide access to Trane global infrastructure. Some of these credentials use the device serial number as a password component — and the serial number is retrievable through unauthenticated API routes (CVE-2026-28254).
Impact: Access to Trane’s centralized management infrastructure. Potential for lateral movement across all connected Trane devices globally.
CVE-2026-28256 — Hard-Coded Security Constants (CVSS 5.8)
Multiple encryption keys and cryptographic material are stored on disk:
- A Blowfish key used to encrypt/decrypt all configuration values (including the credentials in CVE-2026-28255)
- Keys stored on an unmounted block device used for backup encryption and firmware update verification
The Blowfish key enables decryption of any encrypted configuration value. The firmware update keys could enable crafting malicious firmware images.
Impact: Complete compromise of all cryptographic protections on the device. Enables exploitation of CVE-2026-28255 and potentially arbitrary firmware modification.
Attack Chain: From the Internet to the Compressor
Here is how the five CVEs chain together in a realistic attack scenario:
Step 1 — Reconnaissance (CVE-2026-28254): The attacker identifies an internet-exposed Tracer SC+. Unauthenticated API calls reveal the full BACnet network topology, cloud connection status, and device serial numbers.
Step 2 — Key Extraction (CVE-2026-28256): If the attacker has any filesystem access (or obtains firmware from Trane’s downloads), they extract the hardcoded Blowfish key.
Step 3 — Credential Decryption (CVE-2026-28255): Using the Blowfish key, the attacker decrypts stored credentials. Combined with the serial number from Step 1, they can authenticate to Trane remote services.
Step 4 — Root Access (CVE-2026-28252): If the SSH Diagnostic Service is enabled, the attacker calculates the challenge-response using the deterministic cipher and obtains a root shell.
Step 5 — Disruption (CVE-2026-28253, or direct manipulation): With root access, the attacker can modify temperature setpoints, disable cooling loops, suppress alarms, or crash the coordinator via the DoS vulnerability to leave downstream HVAC equipment unmanaged.
The end state: a data center where cooling has stopped and no alarm has fired.
Who Is Affected
The vulnerabilities affect:
- Trane Tracer SC (all versions prior to fix)
- Trane Tracer SC+ (all versions up to v6.2)
- Trane Tracer Concierge (all versions prior to fix)
These controllers are deployed in:
- Data centers (primary cooling coordination)
- Hospitals and healthcare facilities
- Government buildings
- Universities and large campuses
- Commercial office complexes
- Pharmaceutical manufacturing (where temperature control is GMP-critical)
Remediation
Trane recommends upgrading Tracer SC+ controllers to firmware version v6.30.2313 or later.
Additional hardening steps:
- Disable the SSH Diagnostic Service unless actively required for maintenance (eliminates CVE-2026-28252 exposure)
- Isolate BMS controllers from the internet — Tracer SC+ should never be directly reachable from untrusted networks
- Segment BACnet traffic — place building automation on a dedicated VLAN with firewall rules restricting ingress/egress
- Monitor for anomalous BACnet writes — unexpected setpoint changes or mode commands to air handlers and chillers
- Audit internet-facing assets — check Shodan/Censys for exposed Trane web interfaces on your IP ranges
MITRE ATT&CK Mapping
| Tactic | Technique | Application |
|---|---|---|
| Initial Access | T0866 — Exploitation of Remote Services | SSH auth bypass via CVE-2026-28252 |
| Discovery | T0846 — Remote System Discovery | BACnet report enumeration via CVE-2026-28254 |
| Credential Access | T0859 — Valid Accounts | Hardcoded credentials via CVE-2026-28255 |
| Lateral Movement | T0886 — Remote Services | Access to Trane global infrastructure |
| Impact | T0831 — Manipulation of Control | Modify HVAC setpoints and operating modes |
| Impact | T0826 — Loss of Availability | DoS via CVE-2026-28253 or forced thermal shutdown |
Analyst Notes
The broken challenge-response in CVE-2026-28252 is worth highlighting. Using a substitution cipher with hardcoded lookup tables as an authentication mechanism means the “secret” is the algorithm itself. Once the firmware is reverse-engineered — which Team82 demonstrated — every device using that algorithm is compromised simultaneously. This is security through obscurity with no fallback.
The hardcoded global credentials (CVE-2026-28255) compound the problem. These are not per-device credentials that can be rotated individually. They are shared across the entire installed base. A single firmware dump exposes them for every Tracer SC+ in production worldwide.
For OT defenders: this is a textbook example of why building automation systems need the same segmentation discipline as industrial control systems. An HVAC controller with internet exposure and five chainable vulnerabilities is indistinguishable from an unguarded door into your physical infrastructure.
Timeline
| Date | Event |
|---|---|
| 2026 (undisclosed) | Team82 discovers vulnerabilities |
| March 1, 2026 | Trane releases firmware v6.3 with fixes |
| June 9, 2026 | Team82 publishes full technical disclosure |
Leave a Reply
You must be logged in to post a comment.