CVE-2021-38450

🗓️ 27 Oct 2021 00:48:50Reported by icscertType

The affected controllers do not properly sanitize input, allowing attackers to alter software flow

Reporter	Title	Published	Views	Family All 8
CNNVD	Trane Tracer SC 安全漏洞	23 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-38450 Trane Tracer Code Injection	27 Oct 202100:48	–	cvelist
EUVD	EUVD-2021-24902	7 Oct 202500:30	–	euvd
ICS	Trane Tracer	23 Sep 202100:00	–	ics
NVD	CVE-2021-38450	27 Oct 202101:15	–	nvd
Prion	Design/Logic Flaw	27 Oct 202101:15	–	prion
Positive Technologies	PT-2021-22128	27 Oct 202100:00	–	ptsecurity
Tenable Nessus	Trane Tracer Improper Control of Generation of Code (CVE-2021-38450)	23 Oct 202300:00	–	nessus

NVD

Vulners

Node

trane tracer_conciergeRange<5.5

trane tracer_conciergeMatch5.5-

Node

trane tracer_sc_firmwareRange<4.4

trane tracer_sc_firmwareMatch4.4-

AND

trane tracer_scMatch-

Node

trane tracer_sc+_firmwareRange<5.5

trane tracer_sc+_firmwareMatch5.5-

AND

trane tracer_sc+Match-

[
  {
    "product": "Tracer SC",
    "vendor": "Trane",
    "versions": [
      {
        "lessThan": "4.4 SP7",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Tracer SC+",
    "vendor": "Trane",
    "versions": [
      {
        "lessThan": "5.5 SP3",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Tracer Concierge",
    "vendor": "Trane",
    "versions": [
      {
        "lessThan": "5.5 SP3",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
us-cert	www.us-cert.cisa.gov/ics/advisories/icsa-21-266-02

21 Nov 2024 06:17Current

9.2High risk

Vulners AI Score9.2

CVSS 26.5

CVSS 3.18.8 - 9.9

EPSS0.00284

CWE-94