Vulnerabilities

CVSS

5.7 Medium

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Risk score

45.6

Published

2026-07-30

Status

Received

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.

Weaknesses

CWE-321

Coverage 1

vulnerability

Watchfire Controller Software

A critical vulnerability (CVE-2026-5846) exists in Watchfire Controller Software, allowing a malicious user to deliver malicious firmware and gain full control of the device. Multiple versions of the software are affecte…

CISA Advisories · Jul 30, 2026 Critical

CVE-2026-5846UNDOCAcve-2026-5846industrial control systemsfirmware

All articles mentioning it

Advisories and references

• github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-2...
• cisa.gov/news-events/ics-advisories/icsa-26-211-09