Philipp Espernberger, SEC Consult Vulnerability Lab

Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay

Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

Improper branch-code validation in Wertheim SafeController Software allows file path manipulation

Unauthenticated direct access to web data in Wertheim SafeController Software exposes files

Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files

Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files

IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locations

Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions

Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions

Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data