CVE-2026-34023

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34023", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2026-03-25T10:46:45.515Z", "datePublished": "2026-06-15T10:03:11.284Z", "dateUpdated": "2026-06-15T12:27:14.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-06-15T10:03:11.284Z"}, "title": "Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Wertheim GmbH", "product": "Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)", "versions": [{"status": "affected", "version": "Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch."}]}], "references": [{"url": "https://wertheim-safes.com/safe-deposit-box-management/", "tags": ["product"]}, {"url": "https://r.sec-consult.com/wertheim", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "Restrict access to the SafeController web application and WebSocket interface to authorized users and trusted network locations only. Review user privileges and branch assignments. Monitor WebSocket activity for controller identifiers or branch identifiers that do not match the authenticated user's assigned branch. These measures should only be treated as interim risk reduction; the vendor-provided patch should be installed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Restrict access to the SafeController web application and WebSocket interface to authorized users and trusted network locations only. Review user privileges and branch assignments. Monitor WebSocket activity for controller identifiers or branch identifiers that do not match the authenticated user's assigned branch. These measures should only be treated as interim risk reduction; the vendor-provided patch should be installed."}]}], "solutions": [{"lang": "en", "value": "The vendor provides a patch which should be installed immediately. Specific fixed version information was not provided. Affected parties should contact the vendor to request the update.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vendor provides a patch which should be installed immediately. Specific fixed version information was not provided. Affected parties should contact the vendor to request the update."}]}], "credits": [{"lang": "en", "value": "Christian Hager, SEC Consult Vulnerability Lab", "type": "finder"}, {"lang": "en", "value": "Gorazd Jank, SEC Consult Vulnerability Lab", "type": "finder"}, {"lang": "en", "value": "Philipp Espernberger, SEC Consult Vulnerability Lab", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-wertheim-safecontroller-software-for-vault-rooms-safe-deposit-locker-system/", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T12:27:08.513356Z", "id": "CVE-2026-34023", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T12:27:14.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34023", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T12:27:08.513356Z"}}}], "references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-wertheim-safecontroller-software-for-vault-rooms-safe-deposit-locker-system/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T12:26:43.352Z"}}], "cna": {"title": "Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Christian Hager, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Gorazd Jank, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Philipp Espernberger, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wertheim GmbH", "product": "Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)", "versions": [{"status": "affected", "version": "Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The vendor provides a patch which should be installed immediately. Specific fixed version information was not provided. Affected parties should contact the vendor to request the update.", "supportingMedia": [{"type": "text/html", "value": "The vendor provides a patch which should be installed immediately. Specific fixed version information was not provided. Affected parties should contact the vendor to request the update.", "base64": false}]}], "references": [{"url": "https://wertheim-safes.com/safe-deposit-box-management/", "tags": ["product"]}, {"url": "https://r.sec-consult.com/wertheim", "tags": ["third-party-advisory"]}], "workarounds": [{"lang": "en", "value": "Restrict access to the SafeController web application and WebSocket interface to authorized users and trusted network locations only. Review user privileges and branch assignments. Monitor WebSocket activity for controller identifiers or branch identifiers that do not match the authenticated user's assigned branch. These measures should only be treated as interim risk reduction; the vendor-provided patch should be installed.", "supportingMedia": [{"type": "text/html", "value": "Restrict access to the SafeController web application and WebSocket interface to authorized users and trusted network locations only. Review user privileges and branch assignments. Monitor WebSocket activity for controller identifiers or branch identifiers that do not match the authenticated user's assigned branch. These measures should only be treated as interim risk reduction; the vendor-provided patch should be installed.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch.", "supportingMedia": [{"type": "text/html", "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-06-15T10:03:11.284Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34023", "state": "PUBLISHED", "dateUpdated": "2026-06-15T12:27:14.591Z", "dateReserved": "2026-03-25T10:46:45.515Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2026-06-15T10:03:11.284Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)", "vendor": "Wertheim GmbH", "versions": [{"status": "affected", "version": "Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch."}, {"lang": "es", "value": "El software Wertheim SafeController, AssemblyVersion 6.15.8328.28014, contiene una vulnerabilidad de autorizaci\u00f3n incorrecta en la comunicaci\u00f3n WebSocket utilizada por el SafeController WebMessageBroker. Un atacante autenticado con credenciales de usuario de sucursal v\u00e1lidas y de bajo privilegio puede manipular mensajes WebSocket especificando identificadores de controlador pertenecientes a otras sucursales. Esto permite al atacante acceder a funciones y recursos restringidos en otras sucursales, incluyendo la activaci\u00f3n de cajas fuera de la sucursal autorizada del usuario."}], "id": "CVE-2026-34023", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34023", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T12:27:08.513356Z", "version": "2.0.3"}}]}, "published": "2026-06-15T12:16:24.563", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/wertheim"}, {"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://wertheim-safes.com/safe-deposit-box-management/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-wertheim-safecontroller-software-for-vault-rooms-safe-deposit-locker-system/"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)", "source": "cna", "vendor": "Wertheim GmbH"}, "product": "safecontroller_software_for_vault_rooms_(safe_deposit_locker_system)", "vendor": "wertheim"}], "created": "2026-06-15T13:30:05.227971+00:00", "updated": "2026-06-23T21:09:43.711527+00:00", "vendors": ["wertheim", "wertheim$PRODUCT$safecontroller_software_for_vault_rooms_(safe_deposit_locker_system)"]}