CVE-2015-2867

Name of the Vulnerable Software and Affected Versions Trane ComfortLink II SCC firmware version 2.0.2

Description The issue is related to a design flaw in the service that allows remote attackers to gain complete control of the system. It is also associated with the exploitation of predefined credentials, which can allow an attacker to obtain unauthorized access to the device with root privileges using the SSH protocol.

Recommendations For Trane ComfortLink II SCC firmware version 2.0.2, consider changing the predefined credentials to strong, unique ones to prevent exploitation. As a temporary workaround, restrict SSH access to the device until a patch is available.