CVE-2026-5846: Hard-coded Cryptographic Key in Watchfire Controllers

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-30 · updated 2026-09-08
Weakness: CWE-321

Description

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.

Affected products

Watchfire BC550: 12.30
Watchfire BC750: 11.33, 12.35
Watchfire BC760: 12.38, 13.00
Watchfire BC760DC: 12.39

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09

Get alerted when CVE-2026-5846 or the next vulnerability affects your stack