Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2026-5846

Hard-coded Cryptographic Key in Watchfire Controllers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Watchfire BC550

Default version status: unaffected

  • 12.30affected
  • 12.31 SP1unaffected

Watchfire BC750

Default version status: unaffected

  • 11.33affected
  • 11.34unaffected
  • 12.35affected
  • 12.36 SP1unaffected

Watchfire BC760

Default version status: unaffected

  • 12.38affected
  • 12.41 SP1unaffected
  • 13.00affected
  • 14.00 SP1unaffected

Watchfire BC760DC

Default version status: unaffected

  • 12.39affected
  • 12.41 SP1unaffected

References