Hard-coded Cryptographic Key in Watchfire Controllers
Priority LOW 35CWE-321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed BC550 (Watchfire): 12.31 SP1BC750 (Watchfire): 11.34, 12.36 SP1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Watchfire | BC550 | 12.30 | 12.31 SP1 | Patch available | CNA |
| Watchfire | BC750 | 11.33; 12.35 | 11.34, 12.36 SP1 | Patch available | CNA |
| Watchfire | BC760 | 12.38; 13.00 | 12.41 SP1, 14.00 SP1 | Patch available | CNA |
| Watchfire | BC760DC | 12.39 | 12.41 SP1 | Patch available | CNA |
- BC550 VendorWatchfire Affected 12.30 Fixed in 12.31 SP1 Patch available CNA
- BC750 VendorWatchfire Affected 11.33; 12.35 Fixed in 11.34, 12.36 SP1 Patch available CNA
- BC760 VendorWatchfire Affected 12.38; 13.00 Fixed in 12.41 SP1, 14.00 SP1 Patch available CNA
- BC760DC VendorWatchfire Affected 12.39 Fixed in 12.41 SP1 Patch available CNA
Remediation
- Fix · CNA BC550 (Watchfire) Fixed in 12.31 SP1
- Fix · CNA BC750 (Watchfire) Fixed in 11.34, 12.36 SP1
- Fix · CNA BC760 (Watchfire) Fixed in 12.41 SP1, 14.00 SP1
- Fix · CNA BC760DC (Watchfire) Fixed in 12.41 SP1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5846
- 2026-10-03 Alias added: GHSA-5qvx-vvgc-3mv8
References
More Watchfire vulnerabilities
- TI-2008-01937 Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire… CVSS 2.0HIGH 9.3
- TI-2005-04014 Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to… CVSS 2.0HIGH 7.5
Sources
- CVE-2026-5846 · CVE Program
- CVE-2026-5846 · NVD
- FIRST EPSS
- GHSA-5qvx-vvgc-3mv8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences