CVE-2026-34025

{
  "id": "CVE-2026-34025",
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "published": "2026-06-15T12:16:24.867",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. The application restricts user logins based on the IP address associated with a branch location, but the client IP address is derived from the HTTP X-Forwarded-For header when that header is present. An attacker with valid branch user credentials can manipulate the X-Forwarded-For header during login to spoof the expected branch IP address and obtain a valid authenticated session from an unauthorized network location."
    },
    {
      "lang": "es",
      "value": "El software Wertheim SafeController, AssemblyVersion 6.15.8328.28014, contiene una vulnerabilidad de omisión de restricción de IP en el proceso de inicio de sesión. La aplicación restringe los inicios de sesión de usuario basándose en la dirección IP asociada a una ubicación de sucursal, pero la dirección IP del cliente se deriva del encabezado HTTP X-Forwarded-For cuando dicho encabezado está presente. Un atacante con credenciales de usuario de sucursal válidas puede manipular el encabezado X-Forwarded-For durante el inicio de sesión para suplantar la dirección IP de sucursal esperada y obtener una sesión autenticada válida desde una ubicación de red no autorizada."
    }
  ],
  "affected": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "affectedData": [
        {
          "vendor": "Wertheim GmbH",
          "product": "Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T12:28:30.467387Z",
          "id": "CVE-2026-34025",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://r.sec-consult.com/wertheim",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    },
    {
      "url": "https://wertheim-safes.com/safe-deposit-box-management/",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    }
  ]
}