PT-2026-49194 · Wertheim Gmbh · Wertheim Safecontroller Software For Vault Rooms

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-34023

NVD

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-34023

Affected Products

Wertheim Safecontroller Software For Vault Rooms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34023 · Security Note
• https://wertheim-safes.com/safe-deposit-box-management · Note
• https://r.sec-consult.com/wertheim · Note