Vulnerability · Published Jun 15, 2026 · Assigned by SEC-VLab
CVE-2026-34029Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data
Medium 6.8
In plain English
A medium-severity security flaw in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) from Wertheim GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and recover the hard-coded cryptographic key. This key can be used to decrypt the licence.whs file, which contains sensitive information about the licensing party and a second key that can be used to decrypt other configuration files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wertheim GmbH | Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014 |
Weakness: CWE-321 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://wertheim-safes.com/safe-deposit-box-management/ product
- https://r.sec-consult.com/wertheim third-party-advisory