What’s Vulnerable › Vulnerabilities

CVE-2026-34022: Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-15 · updated 2026-10-25
• Weakness: CWE-321

Description

The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt the data traffic. During reassessment, it was possible to break the encryption/decryption routine and decrypt messages without knowledge of the encryption key. It was also possible to gain knowledge about the encryption key by intercepting enough messages.

Affected products

• Wertheim GmbH Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontrolle: from Wertheim SafeController Family 65000, Controller 65000 through AssemblyVersion 6.11.8130.22319

References

• https://r.sec-consult.com/wertdev
• https://wertheim-safes.com/safe-deposit-boxes/
• https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-wertheim-safecontroller-hardware-for-vault-rooms-safe-deposit-locker-system-microcontroller/

Get alerted when CVE-2026-34022 or the next vulnerability affects your stack