CVE-2026-28252
A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.22%
- CWE
- CWE-327
- Published
- 2026-03-12
- Last modified
- 2026-03-13
Affected products
- Trane Tracer SC
- Trane Tracer SC+
- Trane Tracer Concierge
Weakness type
Related vulnerabilities
- CVE-2026-81822 — AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-69382 — Microsoft Exchange Server Information Disclosure Vulnerability
- CVE-2026-16693 — IBM i is Affected By Cryptographic Algorithm Weakness in DCM []
- CVE-2026-81859 — Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- CVE-2026-76133 — Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-39944 — Ceph: CephX AES Authentication error
- CVE-2025-30156 — Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
- CVE-2026-77151 — lin-snow Ech0 crypto.go MD5Encrypt risky encryption