CVE-2026-5846CWE-321

CVE-2026-5846

Medium · published July 31, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-07-31T02:16Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09 · [email protected]
EPSS history
Timeline
  • 30 JUL 21:12Z
    Hard-coded Cryptographic Key in Watchfire Controllers
    cvelistv5