Read the docs
TI-2026-26347 Aliases CVE-2026-34021GHSA-4w8g-q38j-gm8m

Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay

Priority HIGH 72CWE-294Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path between the server and the microcontroller can sniff RS-485 messages and replay previously observed messages. This can be used, for example, to spoof a "quit alarm" message and continuously deactivate the safe alarm.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wertheim GmbHWertheim SafeController 5400 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320—No fix listedCNA
  • Wertheim SafeController 5400 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller) VendorWertheim GmbH Affected Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34021
  2. 2026-10-03 Alias added: GHSA-4w8g-q38j-gm8m

References

Advisory 1

Other 1

  • TI-2026-26349 Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions CVSS 4.0HIGH 7.1
  • TI-2026-26348 Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption CVSS 4.0HIGH 7.1
  • TI-2026-26350 Missing authorization in Wertheim SafeController Software for VAULT ROOMS CVSS 4.0HIGH 8.6
  • TI-2026-26354 Unauthenticated direct access to web data in Wertheim SafeController Software exposes files CVSS 4.0MEDIUM 6.9
  • TI-2026-26352 Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files CVSS 4.0HIGH 7.1
  • TI-2026-26356 Improper branch-code validation in Wertheim SafeController Software allows file path manipulation CVSS 4.0MEDIUM 6.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences