Is CVE-2026-34021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34021 being exploited in the wild.

How severe is CVE-2026-34021?

Informational severity, with a CVSS score of 8.6, published 15 June 2026.

Is there a fix for CVE-2026-34021?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34021 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-34021?

Check whether you run Wertheim SafeController 5400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34021: Wertheim SafeController 5400 lack of cryptographic protection in RS-485 communication

CVE-2026-34021 · Severity: info · CVSS 8.6 · Published 2026-06-15

The Wertheim SafeController 5400, used to manage secure locker systems and vault rooms, contains a vulnerability in how its internal components communicate. Because the communication between the central server and the safe's hardware is not encrypted, an attacker with physical or network access to the wiring can intercept and mimic commands. This could allow an unauthorized person to silence or deactivate safe alarms, potentially facilitating a physical theft without detection.

Vendors: Wertheim.

Quick answers

Is CVE-2026-34021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34021 being exploited in the wild.
How severe is CVE-2026-34021?: Informational severity, with a CVSS score of 8.6, published 15 June 2026.
Which products and versions are affected?: Wertheim SafeController 5400 AssemblyVersion 6.11.8130.22320.
Is there a fix for CVE-2026-34021?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34021 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-34021?: Check whether you run Wertheim SafeController 5400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Wertheim SafeController 5400 (AssemblyVersion 6.11.8130.22320) lacks cryptographic protection on the RS-485 serial communication path between the server and the microcontroller. An attacker with access to the communication medium (adjacent access) can perform a packet-sniffing attack to capture legitimate traffic. By replaying specific captured messages, such as the 'quit alarm' command, the attacker can spoof the server's identity to the microcontroller and continuously deactivate the safe's alarm system. The vendor has stated that no patch will be provided as the hardware is considered End-of-Life (EOL).

Affected products

Wertheim SafeController 5400 AssemblyVersion 6.11.8130.22320

Timeline

2023-04-03: other: Vulnerability discovered by SEC Consult
2023-06-20: other: Initial meeting between SEC Consult and Wertheim
2024-03-29: other: Recheck conducted; vulnerability confirmed as not fixed
2024-10-10: other: Vendor confirms no fix will be provided due to EOL status and hardware limitations
2026-06-15: advisory: Public disclosure of vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.