CVE-2026-34029 PUBLISHED

Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data

Assigner: SEC-VLab
Reserved: 25.03.2026 Published: 15.06.2026 Updated: 15.06.2026

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and recover the hard-coded cryptographic key. This key can be used to decrypt the licence.whs file, which contains sensitive information about the licensing party and a second key that can be used to decrypt other configuration files.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.8

Product Status

Vendor Wertheim GmbH
Product Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
Versions Default: unknown
  • Version Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014 is affected

Workarounds

Restrict filesystem and backup access to the SafeController application installation directory and related configuration files. Ensure that application binaries, licence.whs, and configuration files are not exposed through web-accessible paths or document download functionality. Rotate affected keys and secrets where possible after installing the vendor-provided patch. These measures should only be treated as interim risk reduction; the vendor-provided patch should be installed.

Solutions

The vendor provides a patch which should be installed immediately. Specific fixed version information was not provided. Affected parties should contact the vendor to request the update.

Credits

  • Christian Hager, SEC Consult Vulnerability Lab finder
  • Gorazd Jank, SEC Consult Vulnerability Lab finder
  • Philipp Espernberger, SEC Consult Vulnerability Lab finder

References

Problem Types

  • CWE-321 Use of hard-coded cryptographic key CWE

Impacts

  • CAPEC-37 Retrieve Embedded Sensitive Data