Riskcovery

CVE-2026-5846

Hard-coded Cryptographic Key in Watchfire Controllers

State
Published
Severity
7.6 High
Published
Jul 30, 2026
Updated
Jul 31, 2026
Reserved
Apr 8, 2026

Read the record on cve.org

Description

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.

Scores

CVSSScoreVectorSource
4.07.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Nicscert
3.15.7 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:Nicscert

Weaknesses

  • CWE-321 Use of hard-coded cryptographic key

Affected Products

ProductVersions
BC550Watchfire
  • 12.30Affected
  • 12.31 SP1Not affected
BC750Watchfire
  • 11.33Affected
  • 11.34Not affected
  • 12.35Affected
  • 12.36 SP1Not affected
BC760Watchfire
  • 12.38Affected
  • 12.41 SP1Not affected
  • 13.00Affected
  • 14.00 SP1Not affected
BC760DCWatchfire
  • 12.39Affected
  • 12.41 SP1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.