Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-34022— Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

Quick assessment

Affected

Wertheim GmbH Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wertheim SafeController Family 65000 Hardware for VAULT ROOMS是Wertheim公司的一款用于保险库房间的保险箱锁系统微控制器硬件。 Wertheim SafeController Family 65000 Hardware for VAULT ROOMS 6.11.8130.22319版本存在加密问题漏洞，该漏洞源于使用弱自定义加密算法和硬编码加密密钥，可能导致中间人攻击者解密数据流量，并通过拦截足够消息获取加密密钥。

AI Predicted 7.5 Difficulty: Easy EPSS 0.12% · P2 Updated Jun 15, 2026

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Wertheim GmbH	Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)	`Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-34022

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

Source: CVE Program / CVE List V5

Vulnerability Description

The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt the data traffic. During reassessment, it was possible to break the encryption/decryption routine and decrypt messages without knowledge of the encryption key. It was also possible to gain knowledge about the encryption key by intercepting enough messages.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的密码学密钥

Source: CVE Program / CVE List V5

Vulnerability Title

Wertheim SafeController Family 65000 Hardware for VAULT ROOMS 加密问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Wertheim GmbH	Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)	Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319	-

II. Public POCs for CVE-2026-34022

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-34022

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-34022 (1)

🔗 Multiple Vulnerabilities in Wertheim SafeController Hardware for VAULT ROOMS (Safe Deposit Locker System – Microcontroller) - SEC Consult Read full article third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-34022

Same Patch Batch · Wertheim GmbH · 2026-06-15 · 10 CVEs total

CVE-2026-34024		Missing authorization checks in Wertheim SafeController Software allow low-privileged user
CVE-2026-34028		Unauthenticated direct access to web data in Wertheim SafeController Software exposes file
CVE-2026-34029		Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sens
CVE-2026-34025		IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized
CVE-2026-34026		Path traversal in Wertheim SafeController Software allows authenticated users to download
CVE-2026-34027		Upload restriction bypass in Wertheim SafeController Software allows authenticated users t
CVE-2026-34021		Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sn
CVE-2026-34030		Improper branch-code validation in Wertheim SafeController Software allows file path manip
CVE-2026-34023		Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch acc

IV. Related Vulnerabilities

Same vendor: Wertheim GmbH

Same weakness: CWE-321