CVE-2026-34022: Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

Synopsis

A weak custom cryptography and hard-coded key vulnerability affects the Wertheim SafeController Family 65000 (AssemblyVersion 6.11.8130.22319), a microcontroller used in vault room safe deposit locker systems. An attacker positioned on the same network segment (adjacent network) can perform an adversary-in-the-middle attack to intercept and decrypt controller communications, either by breaking the custom encryption routine directly or by recovering the hard-coded key through traffic analysis. Successful exploitation gives the attacker full visibility into decrypted communication traffic between the controller and connected systems. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be positioned on the same adjacent network (LAN, VLAN, or VPN segment) as the SafeController; remote over-the-internet exploitation is not possible from an arbitrary network location.

• AuthenticationNot required

  No credentials or account access are required; the attacker only needs the ability to intercept traffic on the adjacent network segment.

• Victim interactionNot required

  The attack is entirely passive and network-side; no action is required from any user or operator of the SafeController system.

• Attack complexityDetail

  Exploitation is reliable and condition-free once network adjacency is established; the custom encryption routine can be broken directly or the hard-coded key can be recovered through traffic analysis without additional prerequisites.

Blast Radius

• The attacker reads decrypted communication traffic between the SafeController and connected vault room management systems, exposing any commands, status messages, or operational data transmitted over that channel.
• The attacker can recover the hard-coded encryption key by collecting sufficient intercepted messages, enabling sustained offline decryption of past and future captured traffic.
• Confidentiality of vault room safe deposit locker system operations is fully compromised for any session observable from the adjacent network position.