The Wertheim SafeController 5400 uses RS‑485 communication between the server and the microcontroller without any cryptographic protection. This allows an adversary who can reach the communication path to passively eavesdrop on the traffic, capture command sequences, and later replay them to the device. By replaying a previously observed “quit alarm” message, an attacker can continuously keep the safe alarm off, effectively disabling a critical safety function. The vulnerability is a lack of encryption of in‑band control traffic, a classic example of CWE‑294. The impact is the loss of integrity and availability of the alarm system, as well as potential theft or unauthorized access to the vault contents. The threat model presumes an attacker has physical or network access to the RS‑485 bus. No active exploitation is required beyond replay; no patch is available because the device is end‑of‑life. The severity is high (CVSS 8.6) and the vulnerability is not listed in the CISA KEV database.

Wertheim GmbH SafeController 5400 hardware for vault rooms, part of the Safe Deposit Locker System microcontroller family, AssemblyVersion 6.11.8130.22320. The device is end‑of‑life; no update or support is available from the vendor.

Given the CVSS score of 8.6, this defect is classified as high severity. No EPSS value is supplied, so the likelihood of exploitation cannot be quantified from public data. The vulnerability requires an attacker to reach the RS‑485 communication channel, either through local physical access or unprotected network segments that bridge to the bus; this fact is inferred from the description of the data flow. Because the device is end‑of‑life and no patch is available, mitigations must rely on securing the physical and logical access to the bus. An active exploit simply involves capturing a legitimate command sequence, such as a “quit alarm” message, and replaying it to keep the safety alarm disabled.