CVE-2026-34029 Overview
CVE-2026-34029 affects the Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014. The application ships with a hard-coded cryptographic key embedded in the SafeSystem.Infrastructure.Security.dll component. An attacker with local access to the application files can reverse engineer the DLL and extract this static key. The recovered key decrypts the licence.whs file, which exposes licensing party information and a second key used to decrypt additional configuration files. The weakness is classified under [CWE-321: Use of Hard-coded Cryptographic Key].
Critical Impact
Recovery of the embedded key allows decryption of licensing and configuration files, exposing sensitive deployment data across all installations sharing the same DLL build.
Affected Products
- Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014
- SafeSystem.Infrastructure.Security.dll component
- Wertheim Safe Deposit Box Management deployments using the affected build
Discovery Timeline
- 2026-06-15 - CVE-2026-34029 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-34029
Vulnerability Analysis
The SafeController software relies on symmetric cryptography to protect its licence file and downstream configuration data. The key material is compiled directly into SafeSystem.Infrastructure.Security.dll rather than derived at runtime from an installation-specific secret. Because .NET assemblies are trivial to decompile with tools such as ILSpy or dnSpy, the static key is recoverable by anyone with read access to the binary.
Once extracted, the key decrypts licence.whs. That file contains licensing party identifiers and a second cryptographic key. The secondary key in turn decrypts additional configuration files used by the SafeController. The chained design means a single static secret compromises the full configuration trust boundary.
The issue is local in scope. An attacker must already read the installed application files, for example on a kiosk workstation, a service account share, or a backup image. EPSS reporting places exploitation probability at 0.12% as of 2026-06-18, reflecting the local prerequisite rather than the technical simplicity of the attack.
Root Cause
The root cause is the storage of a long-lived symmetric key inside a shipped library. All installations of AssemblyVersion 6.15.8328.28014 share the same key, so compromise of one binary breaks confidentiality for every deployment using that build.
Attack Vector
An attacker with local file access copies SafeSystem.Infrastructure.Security.dll and licence.whs. The attacker decompiles the DLL, locates the hard-coded key constant, and decrypts licence.whs offline. The extracted second key then unlocks remaining configuration files, revealing deployment secrets.
No verified exploit code is published. The vulnerability mechanism is described in the SEC Consult Security Advisory.
Detection Methods for CVE-2026-34029
Indicators of Compromise
- Unexpected read access to SafeSystem.Infrastructure.Security.dll or licence.whs by non-service accounts
- Presence of .NET decompilation tools such as ILSpy.exe, dnSpy.exe, or dotPeek.exe on SafeController hosts
- Copies of licence.whs or SafeController configuration files outside the installation directory or on removable media
- Outbound transfers of SafeController files to external storage or remote shares
Detection Strategies
- Audit file access events (Windows Event ID 4663) targeting the SafeController installation directory
- Alert on process execution of known .NET reverse engineering tools on hosts running SafeController
- Monitor for archive creation that includes SafeController binaries or .whs files
- Use file integrity monitoring on SafeSystem.Infrastructure.Security.dll to detect tampering or substitution
Monitoring Recommendations
- Forward SafeController host telemetry to a centralized log platform with retention sufficient to investigate offline key extraction
- Track logons and interactive sessions on SafeController workstations, with priority on accounts outside the operator group
- Review backup and imaging jobs to confirm SafeController files are encrypted at rest and access is logged
How to Mitigate CVE-2026-34029
Immediate Actions Required
- Restrict filesystem permissions on the SafeController installation directory to the minimum set of service and operator accounts
- Remove the SafeController installation directory from general-purpose backup shares and apply at-rest encryption to remaining backups
- Inventory all hosts running AssemblyVersion 6.15.8328.28014 and confirm physical and remote access controls
- Contact Wertheim for a fixed build and patch availability
Patch Information
No vendor patch reference is published in the NVD record at the time of writing. Refer to the SEC Consult Security Advisory and the Wertheim Safe Deposit Management product page for vendor coordination and update status.
Workarounds
- Apply application allowlisting to block unauthorized .NET decompilers and archive utilities on SafeController hosts
- Store licence.whs and configuration files on volumes protected by full-disk encryption tied to TPM-bound credentials
- Limit interactive logon rights on SafeController workstations and disable removable media where operationally feasible
- Rotate any credentials or licensing material that may have been exposed if unauthorized file access is suspected
# Restrict access to the SafeController installation directory (Windows)
icacls "C:\Program Files\Wertheim\SafeController" /inheritance:r
icacls "C:\Program Files\Wertheim\SafeController" /grant:r "SafeControllerSvc:(OI)(CI)RX"
icacls "C:\Program Files\Wertheim\SafeController" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\Wertheim\SafeController" /remove "Users"
# Enable auditing on the sensitive files
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
