Watchfire Controller Software: 1 CVE, Medium 5.7
Summary
CISA reports 1 vulnerability in Watchfire BC550, BC750, BC760, BC760DC. Weakness type: Use of Hard-coded Cryptographic Key. Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller. Highest CVSS v3 score: 5.7 (Medium), exploitable over the network.
At a glance
- Vendor
- Watchfire
- Products
- BC550, BC750, BC760, BC760DC
- CVEs
- CVE-2026-5846
- Highest CVSS v3
- 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Critical Manufacturing, Healthcare and Public Health, Financial Services
- Deployed
- United States, Dominican Republic, Canada, Peru, El Salvador
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-5846 | Use of Hard-coded Cryptographic Key | 5.7 | – | No | The affected product contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore. |
Affected products (6)
- Watchfire BC550: 12.30
- Watchfire BC750: 11.33
- Watchfire BC750: 12.35
- Watchfire BC760: 12.38
- Watchfire BC760: 13.00
- Watchfire BC760DC: 12.39
Vendor fixes and mitigations (from advisory)
- Mitigation: Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.
- Vendor Fix: Watchfire has issued patches to disable the use of the existing certificates. Users using BC550; 12.30 should upgrade to 12.31 SP1
- Vendor Fix: Watchfire has issued patches to disable the use of the existing certificates. Users using BC750; 11.33 should upgrade to 11.34
- Vendor Fix: Watchfire has issued patches to disable the use of the existing certificates. Users using BC750; 12.35 should upgrade to 12.36 SP1
- Vendor Fix: Watchfire has issued patches to disable the use of the existing certificates. Users using BC760; 12.38 should upgrade to 12.41 SP1
- Vendor Fix: Watchfire has issued patches to disable the use of the existing certificates. Users using BC760; 13.00 should upgrade to 14.00 SP1
- Vendor Fix: Watchfire has issued patches to disable the use of the existing certificates. Users using BC760DC; 12.39 should upgrade to 12.41 SP1
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.