PT-2026-49194

CVE-2026-34023

Published

2026-06-15

Updated

2026-06-15

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Wertheim SafeController Software version 6.15.8328.28014

Description An incorrect authorization issue exists in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, such as activating boxes outside of their authorized branch.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Christian Hager

Gorazd Jank

Philipp Espernberger

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization