Which versions of Watchfire Controller are affected by EUVD-2026-51313?

Watchfire digital billboard controllers (BC550, BC750, BC760, BC760DC) contain hard-coded shared cryptographic keys embedded in firmware, enabling any attacker who obtains the firmware to decrypt and…

How to fix or mitigate EUVD-2026-51313?

Within 24 hours: Identify all deployed Watchfire digital billboard controllers (BC550, BC750, BC760, BC760DC units and any variants) and document their network location, current firmware version, and criticality to operations. Immediately restrict network access to these controllers to authorized personnel only and disable or restrict remote access capabilities where operationally feasible. Within 7 days: Review Watchfire's advisory and Remote Support repository access controls; revoke unnecessary access to firmware binaries and implement detective monitoring for unauthorized access attempts to both the controllers and the support infrastructure. Prioritize firmware containment and air-gapping of the most critical billboard infrastructure from general corporate networks. Within 30 days: Engage Watchfire support for guidance on firmware updates or workarounds as they become available; evaluate whether controller replacement or hardware upgrades with modern security practices are necessary if Watchfire cannot provide a timely patch; and implement compensating network controls such as VPN-required access and mutual TLS certificate pinning for management interfaces if the underlying vulnerability cannot be eliminated.

Watchfire Controller EUVD-2026-51313

Q: What is the CVSS score of EUVD-2026-51313?

EUVD-2026-51313 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-5846 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-30 icscert

GHSA-5qvx-vvgc-3mv8

Information Disclosure Bc550 Bc750 Bc760 Bc760Dc Watchfire

7.6

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.6 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Shared hard-coded key is network-reachable (AV:N) but needs a MITM position and an admin connecting (AC:H, UI:R); credential and session compromise gives C:H/I:H, no availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 22:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 22:37 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 22:37 NVD

MEDIUM HIGH

CVSS changed

Jul 30, 2026 - 22:37 NVD

5.7 (MEDIUM) 7.6 (HIGH)

Analysis Generated

Jul 30, 2026 - 21:53 vuln.today

DescriptionCVE.org

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.

AnalysisAI

Hard-coded shared RSA private keys and their matching X.509 certificates in Watchfire digital billboard controller software (BC550, BC750, BC760, BC760DC) let an attacker who extracts them decrypt and impersonate the controller's built-in HTTPS/TLS web management interface. Because the keys ship in plaintext inside the firmware patch binaries - retrievable from Watchfire's Remote Support filestore - any attacker with the same firmware can recover the identical keys used across all deployed units. This is an information-disclosure/authentication-bypass class flaw (CWE-321) reported through CISA ICS-CERT; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the TLS/HTTPS layer protecting the web-based management console embedded in Watchfire outdoor LED sign controllers (CPEs cpe:2.3:a:watchfire:bc550/bc750/bc760/bc760dc). TLS authentication and confidentiality depend on the secrecy of the server's RSA private key; here the private key and certificate are not device-unique but are compiled into the application patch binary that Watchfire distributes to every unit. CWE-321 (Use of Hard-coded Cryptographic Key) is the root cause: a single static key protecting many devices means the secret is effectively public, collapsing both the authentication guarantee (an attacker can present the legitimate certificate) and the confidentiality guarantee (traffic can be decrypted). Because the material sits in plaintext in a downloadable firmware/patch artifact, key recovery requires only firmware access, not cryptanalysis.

RemediationAI

Consult CISA advisory ICSA-26-211-09 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09) for the vendor's fixed firmware release; an exact patched version was not provided in the available data, so verify the fix version directly in that advisory before deploying. The durable fix must replace the shared hard-coded key/certificate with a device-unique key pair generated on first boot, so upgrading is only effective if the update regenerates per-device keys - confirm this with Watchfire. As compensating controls until patched: place the controller's web management interface on an isolated management VLAN or behind a firewall and restrict access to a small set of trusted administrator hosts (limits the man-in-the-middle opportunity, at the cost of remote-management convenience); disable or block remote/Internet exposure of the HTTPS interface entirely where feasible; and, where the platform allows, install an organization-generated replacement TLS certificate and private key to invalidate the shared hard-coded pair (side effect: management clients must trust the new certificate). Also revoke and rotate any credentials that may have transited the interface, since they could have been exposed.