CVE-2026-5846
Medium
Description
The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.
SeverityMedium
CVSS5.7
Exploit probability—
ProductBC550
PublishedJul 30, 2026
First seenJul 30, 2026
Weakness typeCWE-321CWE-321
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Watchfire BC550 | 12.30 | — |
| Watchfire BC750 | 11.33, 12.35 | — |
| Watchfire BC760 | 12.38, 13.00 | — |
| Watchfire BC760DC | 12.39 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.