CVE-2026-34021/22: Insecure Communication in Wertheim SafeController Hardware

Vulnerability Overview Title: Multiple Vulnerabilities in Wertheim SafeController Hardware for VAULT ROOMS (Safe Deposit Locker System – Microcontroller) CVE IDs: CVE-2026-34021, CVE-2026-34022 Impact: High Disclosure Date: April 3, 2023 Authors: Gorazd Jank, Christian Hager, Philipp Espenberger (Office Vienna) Affected Products Affected Products: Wertheim SafeController Hardware for VAULT ROOMS (Safe Deposit Locker System – Microcontroller) Affected Versions: - Controller 65000 - AssemblyVersion 6.11.8130.22319 - Controller 5400 - AssemblyVersion 6.11.8130.22320 Fixed Versions: No fix available (Issue 1 & 2); No information available for Issue 3 Remediation Management Recommendations: - The affected HW controller 5400 has been marked as End-of-Life (EOL); therefore, no patches will be provided. - It is recommended to assess business risks and switch to supported versions if any EOL products are in use. Vulnerability Details: 1. Missing Encryption Protection on SafeController 5400 (CVE-2026-34021) - Serial communication between the microcontroller and the server is not encrypted. An attacker can sniff all RS-485 messages and use them for replay attacks. - POC Code: Not provided (as no patch will be released) 2. Insufficient Transport Layer Encryption on SafeController 65000 (CVE-2026-34022) - The SafeController Family 65000 uses weak and proprietary encryption algorithms, allowing an attacker in a man-in-the-middle position to read and decrypt data traffic. - POC Code: Not provided (as no patch will be released) 3. Undisclosed Vulnerability in Binary SafeController - This vulnerability was identified during a re-evaluation commissioned by Wertheim. Detailed disclosure was withheld as the discovery falls under the vendor's ownership and disclosure rights. - POC Code: Not provided (due to non-disclosure) Solution Temporary Mitigations: - Physically isolate all SafeController devices to ensure only authorized personnel can access them. - Harden all devices communicating via serial interfaces, including applying restrictive configurations and disabling unnecessary services. - Ensure that servers communicating with SafeController devices via serial interfaces are protected using strong, unique authentication credentials. Avoid using default, shared, or weak credentials. Access should be limited to authorized personnel with legitimate operational needs. - Ensure the physical security of all interconnected components to prevent unauthorized physical access or tampering. Additional Information Vendor Contact Timeline: Detailed records of multiple communications and meetings from June 28, 2023, to June 15, 2024, including vulnerability reports, status updates, and the final issuance of security advisories. References: https://sec-consult.com/vulnerability-lab/ --- EOF Gorazd Jank, Christian Hager, Philipp Espenberger / @2026

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-34021/22: Insecure Communication in Wertheim SafeController Hardware