CVE-2026-34021: Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay

Synopsis

This is a missing cryptographic protection vulnerability in the Wertheim SafeController 5400 (AssemblyVersion 6.11.8130.22320), a microcontroller used in safe deposit locker systems. An attacker with access to the RS-485 communication bus between the server and the microcontroller can passively capture messages and replay them without any authentication. Successful exploitation allows the attacker to spoof control messages, such as a 'quit alarm' command, and continuously suppress the safe alarm. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must have access to the adjacent RS-485 communication bus, such as through physical LAN, wired bus access, or a position on the local network segment connecting the server and microcontroller; remote exploitation over the internet is not applicable.

• AuthenticationNot required

  No credentials or account are needed; the RS-485 bus carries unprotected plaintext messages that any bus participant can read and replay.

• Victim interactionNot required

  The attacker does not require any action from an operator or end user to capture or replay messages.

• Attack complexityDetail

  Exploitation is reliable and condition-free once bus access is established; no race conditions or special environmental factors are required.

Blast Radius

• Attacker reads all RS-485 messages in transit, including alarm state commands and control signals, capturing the full plaintext communication between server and microcontroller.
• Attacker replays captured control messages to issue arbitrary commands to the microcontroller, such as repeatedly sending a 'quit alarm' instruction to suppress the safe alarm indefinitely.
• Physical security of the vault room or safe deposit locker system is undermined, as alarm suppression can mask unauthorized access attempts from security staff.