CVE-2021-38448
Trane Symbio Improper Control of Generation of Code
02 Description
Trane Symbio Improper Control of Generation of Code
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.28% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 21.2% of scored records. A rank, not a probability.
- NVD base score
- 7.6 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2021-11-22 18:58Z4 YR AGO
- Last updated
- 2024-08-04 01:44Z2 YR AGO
- Reserved
- 2021-08-10
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.5)
- CNA CVSS vector
- CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
- Weaknesses
- CWE-94Improper Control of Generation of Code ('Code Injection')Base
- Data version
- 5.1
- Document digest
- 434d89a24b180b8aff00e0f52dfe1c9788b56ce540cd685ec2584c1a6771b6f6
05 Affected products
06 References
- us-cert.cisa.govhttps://us-cert.cisa.gov/ics/advisories/icsa-21-266-01
07 Remediation
Affected users should contact a Trane representative to install updated firmware or request additional information. Please reference Trane service database number HUB-205962 when contacting the Trane office. Trane has identified the following specific mitigations: Symbio 700 controllers: Upgrade to v1.00.0023 or later Symbio 800 controllers: Upgrade to v1.00.0007 or later In addition to the specific recommendations above, Trane continues to recommend the following best practices as an additional protection against this and other controller vulnerabilities: Restrict physical controller access to trained and trusted personnel. Use secure remote access solutions, such as Trane Connect Remote Access, when needed. Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords). Have a well-documented process and owner to ensure regular software/firmware updates and keep systems up to date.