CVE-2026-34023: Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions

Synopsis

Broken authorization in the WebSocket layer of Wertheim SafeController Software (AssemblyVersion 6.15.8328.28014) allows an attacker to cross branch boundaries inside a safe deposit locker management system. An authenticated low-privilege user can reach the vulnerable endpoint over the network and manipulate WebSocket messages to reference controller identifiers belonging to other branches, bypassing access controls. Successful exploitation lets the attacker invoke restricted functions in foreign branches, including activating safe deposit boxes they are not authorized to control. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SafeController WebMessageBroker's WebSocket endpoint over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  A valid low-privilege branch user account is required; any authenticated user with branch-level credentials is sufficient to attempt exploitation.

• Victim interactionNot required

  No victim action is needed; the attacker manipulates WebSocket messages directly without requiring another user to click or approve anything.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors required to manipulate the controller identifier in a WebSocket message.

Blast Radius

• The attacker reads data belonging to branches outside their authorized scope, including branch-level resource listings and controller state.
• The attacker modifies branch state in foreign branches by invoking restricted functions, including activating safe deposit boxes that belong to other customers or organizational units.
• Integrity of the physical access-control system is undermined: unauthorized box activations represent real-world physical access to secured compartments.
• Audit and compliance records for affected branches may reflect unauthorized operations, creating accountability and forensic integrity problems.