CVE-2026-5846

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5846", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-04-08T18:55:38.436Z", "datePublished": "2026-07-30T21:12:42.825Z", "dateUpdated": "2026-07-31T20:12:49.282Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-07-31T20:12:49.282Z"}, "title": "Hard-coded Cryptographic Key in Watchfire Controllers", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-321", "description": "CWE-321 Use of hard-coded cryptographic key", "type": "CWE"}]}], "affected": [{"vendor": "Watchfire", "product": "BC550", "versions": [{"status": "affected", "version": "12.30"}, {"status": "unaffected", "version": "12.31 SP1"}], "defaultStatus": "unaffected"}, {"vendor": "Watchfire", "product": "BC750", "versions": [{"status": "affected", "version": "11.33"}, {"status": "unaffected", "version": "11.34"}, {"status": "affected", "version": "12.35"}, {"status": "unaffected", "version": "12.36 SP1"}], "defaultStatus": "unaffected"}, {"vendor": "Watchfire", "product": "BC760", "versions": [{"status": "affected", "version": "12.38"}, {"status": "unaffected", "version": "12.41 SP1"}, {"status": "affected", "version": "13.00"}, {"status": "unaffected", "version": "14.00 SP1"}], "defaultStatus": "unaffected"}, {"vendor": "Watchfire", "product": "BC760DC", "versions": [{"status": "affected", "version": "12.39"}, {"status": "unaffected", "version": "12.41 SP1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The affected\u00a0Watchfire Controller Software\u00a0contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The affected&nbsp;Watchfire Controller Software&nbsp;contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore."}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.6, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\n\n\n\nWatchfire has issued patches to disable the use of the existing certificate as follows:\u00a0\n\n * BC550 12.30: Patch to 12.31 SP1\n * BC750 11.33: Patch to 11.34\n * BC750 12.35: Patch to 12.36 SP1\n * BC760 12.38: Patch to 12.41 SP1\n * BC760 13.00: Patch to 14.00 SP1\n * BC760DC 12.39: Patch to 12.41 SP1", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.</p><p>Watchfire has issued patches to disable the use of the existing certificate as follows:&nbsp;</p><ul><li>BC550 12.30: Patch to 12.31 SP1</li><li>BC750 11.33: Patch to 11.34</li><li>BC750 12.35: Patch to 12.36 SP1</li><li>BC760 12.38: Patch to 12.41 SP1</li><li>BC760 13.00: Patch to 14.00 SP1</li><li>BC760DC 12.39: Patch to 12.41 SP1</li></ul>"}]}], "credits": [{"lang": "en", "value": "James Tilson reported the vulnerability to CISA", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "source": {"advisory": "ICSA-26-211-09", "discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T15:31:12.383337Z", "id": "CVE-2026-5846", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:31:33.658Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T15:31:12.383337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:31:29.453Z"}}], "cna": {"title": "Hard-coded Cryptographic Key in Watchfire Controllers", "source": {"advisory": "ICSA-26-211-09", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "James Tilson reported the vulnerability to CISA"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Watchfire", "product": "BC550", "versions": [{"status": "affected", "version": "12.30"}, {"status": "unaffected", "version": "12.31 SP1"}], "defaultStatus": "unaffected"}, {"vendor": "Watchfire", "product": "BC750", "versions": [{"status": "affected", "version": "11.33"}, {"status": "unaffected", "version": "11.34"}, {"status": "affected", "version": "12.35"}, {"status": "unaffected", "version": "12.36 SP1"}], "defaultStatus": "unaffected"}, {"vendor": "Watchfire", "product": "BC760", "versions": [{"status": "affected", "version": "12.38"}, {"status": "unaffected", "version": "12.41 SP1"}, {"status": "affected", "version": "13.00"}, {"status": "unaffected", "version": "14.00 SP1"}], "defaultStatus": "unaffected"}, {"vendor": "Watchfire", "product": "BC760DC", "versions": [{"status": "affected", "version": "12.39"}, {"status": "unaffected", "version": "12.41 SP1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\n\n\n\nWatchfire has issued patches to disable the use of the existing certificate as follows:\u00a0\n\n * BC550 12.30: Patch to 12.31 SP1\n * BC750 11.33: Patch to 11.34\n * BC750 12.35: Patch to 12.36 SP1\n * BC760 12.38: Patch to 12.41 SP1\n * BC760 13.00: Patch to 14.00 SP1\n * BC760DC 12.39: Patch to 12.41 SP1", "supportingMedia": [{"type": "text/html", "value": "<p>Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.</p><p>Watchfire has issued patches to disable the use of the existing certificate as follows:&nbsp;</p><ul><li>BC550 12.30: Patch to 12.31 SP1</li><li>BC750 11.33: Patch to 11.34</li><li>BC750 12.35: Patch to 12.36 SP1</li><li>BC760 12.38: Patch to 12.41 SP1</li><li>BC760 13.00: Patch to 14.00 SP1</li><li>BC760DC 12.39: Patch to 12.41 SP1</li></ul>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The affected\u00a0Watchfire Controller Software\u00a0contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.", "supportingMedia": [{"type": "text/html", "value": "The affected&nbsp;Watchfire Controller Software&nbsp;contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of hard-coded cryptographic key"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-07-31T20:12:49.282Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5846", "state": "PUBLISHED", "dateUpdated": "2026-07-31T20:12:49.282Z", "dateReserved": "2026-04-08T18:55:38.436Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-07-30T21:12:42.825Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BC550", "vendor": "Watchfire", "versions": [{"status": "affected", "version": "12.30"}, {"status": "unaffected", "version": "12.31 SP1"}]}, {"defaultStatus": "unaffected", "product": "BC750", "vendor": "Watchfire", "versions": [{"status": "affected", "version": "11.33"}, {"status": "unaffected", "version": "11.34"}, {"status": "affected", "version": "12.35"}, {"status": "unaffected", "version": "12.36 SP1"}]}, {"defaultStatus": "unaffected", "product": "BC760", "vendor": "Watchfire", "versions": [{"status": "affected", "version": "12.38"}, {"status": "unaffected", "version": "12.41 SP1"}, {"status": "affected", "version": "13.00"}, {"status": "unaffected", "version": "14.00 SP1"}]}, {"defaultStatus": "unaffected", "product": "BC760DC", "vendor": "Watchfire", "versions": [{"status": "affected", "version": "12.39"}, {"status": "unaffected", "version": "12.41 SP1"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The affected\u00a0Watchfire Controller Software\u00a0contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore."}], "id": "CVE-2026-5846", "lastModified": "2026-09-08T19:30:43.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5846", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T15:31:12.383337Z", "version": "2.0.3"}}]}, "published": "2026-07-30T22:16:55.107", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.30"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "12.31 SP1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BC550", "source": "cna", "vendor": "Watchfire"}, "product": "bc550", "vendor": "watchfire"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.33"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.34"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.35"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "12.36 SP1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BC750", "source": "cna", "vendor": "Watchfire"}, "product": "bc750", "vendor": "watchfire"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.38"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "12.41 SP1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "13.00"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "14.00 SP1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BC760", "source": "cna", "vendor": "Watchfire"}, "product": "bc760", "vendor": "watchfire"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.39"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "12.41 SP1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BC760DC", "source": "cna", "vendor": "Watchfire"}, "product": "bc760dc", "vendor": "watchfire"}], "created": "2026-08-02T20:34:29.762707+00:00", "updated": "2026-08-03T10:30:18.422957+00:00", "vendors": ["watchfire", "watchfire$PRODUCT$bc550", "watchfire$PRODUCT$bc750", "watchfire$PRODUCT$bc760", "watchfire$PRODUCT$bc760dc"]}