CVE-2021-38448

HIGH 7.6CVE-2021-38448 · Published 22/11/2021 · updated 17/06/2026

In short

CVE-2021-38448 is a HIGH (CVSS 7.6) vulnerability affecting symbio 700 (trane), symbio 800 (trane).
Chance of exploitation in the next 30 days (EPSS): 0.29%, higher than 21.5% of all vulnerabilities.
Fix: update to 1.00.0023, 1.10.0010, 1.30.0008 or later.

Package	Affected versions	Patched versions
symbio 700 trane	`< 1.00.0023`	`1.00.0023`
symbio 800 trane	`< 1.10.0010< 1.30.0008`	`1.10.00101.30.0008`

Description

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

References

us-cert.cisa.gov/ics/advisories/icsa-21-266-01 · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free