Vulnerability · Published Jun 15, 2026 · Assigned by SEC-VLab

CVE-2026-34028Unauthenticated direct access to web data in Wertheim SafeController Software exposes files

Medium 6.9

In plain English

A medium-severity security flaw in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) from Wertheim GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from locations such as /Resources/CompanyId_[ID]/Audio/ and /SafeData/.

Affected products (as reported)

Vendor	Product	Versions
Wertheim GmbH	Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)	Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014

Weakness: CWE-425 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://wertheim-safes.com/safe-deposit-box-management/ product
https://r.sec-consult.com/wertheim third-party-advisory