CVE-2021-38448: Trane Symbio 700

High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected products

• Trane Symbio 700: before 1.00.0023 (fixed in 1.00.0023)
• Trane Symbio 800: before 1.30.0008 (fixed in 1.30.0008); before 1.10.0010 (fixed in 1.10.0010)

Published 2021-11-22. Last modified 2026-06-17.