Trane patched two of the bugs in April 2015 and fixed the third vulnerability as of Jan. 27, 2016. The vulnerabilities could have allowed bad actors to remotely access and operate the thermostats ...