CVE-2026-34028
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from locations such as /Resources/CompanyId_[ID]/Audio/ and /SafeData/.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.40%
- CWE
- CWE-425
- Published
- 2026-06-15
- Last modified
- 2026-06-15
Affected products
- Wertheim GmbH Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
Weakness type
Related vulnerabilities
- CVE-2026-78051 — alexta69 MeTube Cookie File cookies.txt file access
- CVE-2026-14953 — Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control
- CVE-2026-76799 — code-projects Login Registration System SQL Database Backup login_registration_system.sql file access
- CVE-2026-19903 — SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
- CVE-2026-60011 — Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly...
- CVE-2026-21760 — Unauthorized Access to Admin Functionality via Forced Browsing
- CVE-2024-23573 — HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that...
- CVE-2026-13533 — agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access