Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Watchfire
CVE-2026-5846 (GCVE-0-2026-5846)
Vulnerability from nvd – Published: 2026-07-30 21:12 – Updated: 2026-07-31 20:12
VLAI
EPSS
VEX
Title
Hard-coded Cryptographic Key in Watchfire Controllers
Summary
The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Watchfire | BC550 |
Affected:
12.30
Unaffected: 12.31 SP1 |
|
| Watchfire | BC750 |
Affected:
11.33
Unaffected: 11.34 Affected: 12.35 Unaffected: 12.36 SP1 |
|
| Watchfire | BC760 |
Affected:
12.38
Unaffected: 12.41 SP1 Affected: 13.00 Unaffected: 14.00 SP1 |
|
| Watchfire | BC760DC |
Affected:
12.39
Unaffected: 12.41 SP1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:31:12.383337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:31:33.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BC550",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.30"
},
{
"status": "unaffected",
"version": "12.31 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC750",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "11.33"
},
{
"status": "unaffected",
"version": "11.34"
},
{
"status": "affected",
"version": "12.35"
},
{
"status": "unaffected",
"version": "12.36 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC760",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.38"
},
{
"status": "unaffected",
"version": "12.41 SP1"
},
{
"status": "affected",
"version": "13.00"
},
{
"status": "unaffected",
"version": "14.00 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC760DC",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.39"
},
{
"status": "unaffected",
"version": "12.41 SP1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Tilson reported the vulnerability to CISA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected\u0026nbsp;Watchfire Controller Software\u0026nbsp;contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller\u0027s built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire\u0027s Remote Support filestore."
}
],
"value": "The affected\u00a0Watchfire Controller Software\u00a0contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller\u0027s built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire\u0027s Remote Support filestore."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:12:49.282Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWatchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\u003c/p\u003e\u003cp\u003eWatchfire has issued patches to disable the use of the existing certificate as follows:\u0026nbsp;\u003c/p\u003e\u003cul\u003e\u003cli\u003eBC550 12.30: Patch to 12.31 SP1\u003c/li\u003e\u003cli\u003eBC750 11.33: Patch to 11.34\u003c/li\u003e\u003cli\u003eBC750 12.35: Patch to 12.36 SP1\u003c/li\u003e\u003cli\u003eBC760 12.38: Patch to 12.41 SP1\u003c/li\u003e\u003cli\u003eBC760 13.00: Patch to 14.00 SP1\u003c/li\u003e\u003cli\u003eBC760DC 12.39: Patch to 12.41 SP1\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\n\n\n\nWatchfire has issued patches to disable the use of the existing certificate as follows:\u00a0\n\n * BC550 12.30: Patch to 12.31 SP1\n * BC750 11.33: Patch to 11.34\n * BC750 12.35: Patch to 12.36 SP1\n * BC760 12.38: Patch to 12.41 SP1\n * BC760 13.00: Patch to 14.00 SP1\n * BC760DC 12.39: Patch to 12.41 SP1"
}
],
"source": {
"advisory": "ICSA-26-211-09",
"discovery": "EXTERNAL"
},
"title": "Hard-coded Cryptographic Key in Watchfire Controllers",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-5846",
"datePublished": "2026-07-30T21:12:42.825Z",
"dateReserved": "2026-04-08T18:55:38.436Z",
"dateUpdated": "2026-07-31T20:12:49.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2008-2015 (GCVE-0-2008-2015)
Vulnerability from nvd – Published: 2008-04-30 01:00 – Updated: 2024-08-07 08:41
VLAI
EPSS
VEX
Summary
Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/5496 | exploitx_refsource_EXPLOIT-DB |
| http://www.securityfocus.com/bid/28940 | vdb-entryx_refsource_BID |
| http://www.securitytracker.com/id?1019948 | vdb-entryx_refsource_SECTRACK |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2008-04-25 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:41:00.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "5496",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5496"
},
{
"name": "28940",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28940"
},
{
"name": "1019948",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019948"
},
{
"name": "appscan-activex-file-overwrite(42077)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42077"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-04-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "5496",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5496"
},
{
"name": "28940",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28940"
},
{
"name": "1019948",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019948"
},
{
"name": "appscan-activex-file-overwrite(42077)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42077"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-2015",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "5496",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5496"
},
{
"name": "28940",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28940"
},
{
"name": "1019948",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019948"
},
{
"name": "appscan-activex-file-overwrite(42077)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42077"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-2015",
"datePublished": "2008-04-30T01:00:00.000Z",
"dateReserved": "2008-04-29T00:00:00.000Z",
"dateUpdated": "2024-08-07T08:41:00.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4270 (GCVE-0-2005-4270)
Vulnerability from nvd – Published: 2005-12-15 20:00 – Updated: 2024-08-07 23:38
VLAI
EPSS
VEX
Summary
Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/15873 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/18013 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/419586/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.cybsec.com/vuln/CYBSEC_Security_Adviso… | x_refsource_MISC |
| http://securitytracker.com/id?1015362 | vdb-entryx_refsource_SECTRACK |
| http://securityreason.com/securityalert/260 | third-party-advisoryx_refsource_SREASON |
| http://www.vupen.com/english/advisories/2005/2933 | vdb-entryx_refsource_VUPEN |
Date Public
2005-12-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:38:51.589Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15873",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15873"
},
{
"name": "18013",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18013"
},
{
"name": "20051215 CYBSEC - Security Advisory: Watchfire AppScan QA Remote Code Execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/419586/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf"
},
{
"name": "1015362",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015362"
},
{
"name": "260",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/260"
},
{
"name": "ADV-2005-2933",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2933"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15873",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15873"
},
{
"name": "18013",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18013"
},
{
"name": "20051215 CYBSEC - Security Advisory: Watchfire AppScan QA Remote Code Execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/419586/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf"
},
{
"name": "1015362",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015362"
},
{
"name": "260",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/260"
},
{
"name": "ADV-2005-2933",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2933"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4270",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15873",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15873"
},
{
"name": "18013",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18013"
},
{
"name": "20051215 CYBSEC - Security Advisory: Watchfire AppScan QA Remote Code Execution",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/419586/100/0/threaded"
},
{
"name": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf",
"refsource": "MISC",
"url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf"
},
{
"name": "1015362",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015362"
},
{
"name": "260",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/260"
},
{
"name": "ADV-2005-2933",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2933"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4270",
"datePublished": "2005-12-15T20:00:00.000Z",
"dateReserved": "2005-12-15T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:38:51.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-5846 (GCVE-0-2026-5846)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:12 – Updated: 2026-07-31 20:12
VLAI
EPSS
VEX
Title
Hard-coded Cryptographic Key in Watchfire Controllers
Summary
The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Watchfire | BC550 |
Affected:
12.30
Unaffected: 12.31 SP1 |
|
| Watchfire | BC750 |
Affected:
11.33
Unaffected: 11.34 Affected: 12.35 Unaffected: 12.36 SP1 |
|
| Watchfire | BC760 |
Affected:
12.38
Unaffected: 12.41 SP1 Affected: 13.00 Unaffected: 14.00 SP1 |
|
| Watchfire | BC760DC |
Affected:
12.39
Unaffected: 12.41 SP1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:31:12.383337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:31:33.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BC550",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.30"
},
{
"status": "unaffected",
"version": "12.31 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC750",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "11.33"
},
{
"status": "unaffected",
"version": "11.34"
},
{
"status": "affected",
"version": "12.35"
},
{
"status": "unaffected",
"version": "12.36 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC760",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.38"
},
{
"status": "unaffected",
"version": "12.41 SP1"
},
{
"status": "affected",
"version": "13.00"
},
{
"status": "unaffected",
"version": "14.00 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC760DC",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.39"
},
{
"status": "unaffected",
"version": "12.41 SP1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Tilson reported the vulnerability to CISA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected\u0026nbsp;Watchfire Controller Software\u0026nbsp;contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller\u0027s built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire\u0027s Remote Support filestore."
}
],
"value": "The affected\u00a0Watchfire Controller Software\u00a0contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller\u0027s built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire\u0027s Remote Support filestore."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:12:49.282Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWatchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\u003c/p\u003e\u003cp\u003eWatchfire has issued patches to disable the use of the existing certificate as follows:\u0026nbsp;\u003c/p\u003e\u003cul\u003e\u003cli\u003eBC550 12.30: Patch to 12.31 SP1\u003c/li\u003e\u003cli\u003eBC750 11.33: Patch to 11.34\u003c/li\u003e\u003cli\u003eBC750 12.35: Patch to 12.36 SP1\u003c/li\u003e\u003cli\u003eBC760 12.38: Patch to 12.41 SP1\u003c/li\u003e\u003cli\u003eBC760 13.00: Patch to 14.00 SP1\u003c/li\u003e\u003cli\u003eBC760DC 12.39: Patch to 12.41 SP1\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\n\n\n\nWatchfire has issued patches to disable the use of the existing certificate as follows:\u00a0\n\n * BC550 12.30: Patch to 12.31 SP1\n * BC750 11.33: Patch to 11.34\n * BC750 12.35: Patch to 12.36 SP1\n * BC760 12.38: Patch to 12.41 SP1\n * BC760 13.00: Patch to 14.00 SP1\n * BC760DC 12.39: Patch to 12.41 SP1"
}
],
"source": {
"advisory": "ICSA-26-211-09",
"discovery": "EXTERNAL"
},
"title": "Hard-coded Cryptographic Key in Watchfire Controllers",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-5846",
"datePublished": "2026-07-30T21:12:42.825Z",
"dateReserved": "2026-04-08T18:55:38.436Z",
"dateUpdated": "2026-07-31T20:12:49.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2008-2015 (GCVE-0-2008-2015)
Vulnerability from cvelistv5 – Published: 2008-04-30 01:00 – Updated: 2024-08-07 08:41
VLAI
EPSS
VEX
Summary
Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/5496 | exploitx_refsource_EXPLOIT-DB |
| http://www.securityfocus.com/bid/28940 | vdb-entryx_refsource_BID |
| http://www.securitytracker.com/id?1019948 | vdb-entryx_refsource_SECTRACK |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2008-04-25 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:41:00.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "5496",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5496"
},
{
"name": "28940",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28940"
},
{
"name": "1019948",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019948"
},
{
"name": "appscan-activex-file-overwrite(42077)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42077"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-04-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "5496",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5496"
},
{
"name": "28940",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28940"
},
{
"name": "1019948",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019948"
},
{
"name": "appscan-activex-file-overwrite(42077)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42077"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-2015",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "5496",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5496"
},
{
"name": "28940",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28940"
},
{
"name": "1019948",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019948"
},
{
"name": "appscan-activex-file-overwrite(42077)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42077"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-2015",
"datePublished": "2008-04-30T01:00:00.000Z",
"dateReserved": "2008-04-29T00:00:00.000Z",
"dateUpdated": "2024-08-07T08:41:00.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4270 (GCVE-0-2005-4270)
Vulnerability from cvelistv5 – Published: 2005-12-15 20:00 – Updated: 2024-08-07 23:38
VLAI
EPSS
VEX
Summary
Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/15873 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/18013 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/419586/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.cybsec.com/vuln/CYBSEC_Security_Adviso… | x_refsource_MISC |
| http://securitytracker.com/id?1015362 | vdb-entryx_refsource_SECTRACK |
| http://securityreason.com/securityalert/260 | third-party-advisoryx_refsource_SREASON |
| http://www.vupen.com/english/advisories/2005/2933 | vdb-entryx_refsource_VUPEN |
Date Public
2005-12-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:38:51.589Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15873",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15873"
},
{
"name": "18013",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18013"
},
{
"name": "20051215 CYBSEC - Security Advisory: Watchfire AppScan QA Remote Code Execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/419586/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf"
},
{
"name": "1015362",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015362"
},
{
"name": "260",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/260"
},
{
"name": "ADV-2005-2933",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2933"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15873",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15873"
},
{
"name": "18013",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18013"
},
{
"name": "20051215 CYBSEC - Security Advisory: Watchfire AppScan QA Remote Code Execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/419586/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf"
},
{
"name": "1015362",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015362"
},
{
"name": "260",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/260"
},
{
"name": "ADV-2005-2933",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2933"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4270",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15873",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15873"
},
{
"name": "18013",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18013"
},
{
"name": "20051215 CYBSEC - Security Advisory: Watchfire AppScan QA Remote Code Execution",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/419586/100/0/threaded"
},
{
"name": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf",
"refsource": "MISC",
"url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_AppScanQA_RemoteCodeExec.pdf"
},
{
"name": "1015362",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015362"
},
{
"name": "260",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/260"
},
{
"name": "ADV-2005-2933",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2933"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4270",
"datePublished": "2005-12-15T20:00:00.000Z",
"dateReserved": "2005-12-15T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:38:51.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}