CVE-2021-38450: Trane Tracer Concierge

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Affected products

• Trane Tracer Concierge: before 5.5 (fixed in 5.5); version 5.5 only
• Trane Tracer Sc+ Firmware: before 5.5 (fixed in 5.5); version 5.5 only
• Trane Tracer Sc Firmware: before 4.4 (fixed in 4.4); version 4.4 only

Published 2021-10-27. Last modified 2026-06-17.