CVE-2021-38450 Trane Tracer Code Injection
Attackers can inject malicious code into Trane Tracer controllers to alter software flow, requiring vendor patches for building automation systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38450?
CVE-2021-38450 is a critical code injection vulnerability in Trane Tracer Concierge, published on 27 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
Weakness: CWE-94
Which versions are affected by CVE-2021-38450?
It affects 3 products.
Products include Trane Tracer Concierge, Trane Tracer Sc\+ Firmware, Trane Tracer Sc Firmware.
How do I fix CVE-2021-38450?
No fix has been published for CVE-2021-38450 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-38450 being exploited?
There is no known exploitation of CVE-2021-38450 in the wild and no public exploit code.
Other vulnerabilities in Trane Tracer Concierge
- CVE-2026-28252 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28253 Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28255 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28254 Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2026-28256 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
Sources
Also known as GHSA-m3xr-5f4w-px4w.