Global
Watchfire sign controllers ship hard-coded plaintext TLS keys (CVE-2026-5846)
Watchfire controller software for BC550, BC750, BC760 and BC760DC sign controllers ships self-signed RSA private keys for the HTTPS web management interface. The keys sit in plaintext inside the firmware patch binaries, so anyone who downloads a patch can recover them. Scores conflict (7.6 under CVSS 4.0 and 5.7 under CVSS 3), and the sources checked report no confirmed exploitation.
- Type
- Vulnerability
- Sector
- Other
- Country
- Global
Sources
- CVE-2026-5846 · NIST NVD