The vulnerability resides in the login process of Wertheim SafeController Software version AssemblyVersion 6.15.8328.28014. It allows an attacker to forge the client IP address by manipulating the X-Forwarded-For header. The application erroneously uses that header to enforce IP‑based branch restrictions, effectively bypassing the intended authorization check and enabling an unauthorized network‑based login. This weakness is an authentication exception (CWE‑290).

The product is Wertheim SafeController Software for VAULT ROOMS, part of a Safe Deposit Locker System supplied by Wertheim GmbH. The affected release is AssemblyVersion 6.15.8328.28014. No fixed release is currently documented; users must request the vendor patch.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so no current exploitation probability can be quantified. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. Based on the description, it is inferred that the attack vector involves an attacker sending a crafted HTTP request to the login endpoint with a spoofed X-Forwarded-For header. An attacker requires valid branch user credentials and the ability to transmit network traffic to the SafeController web application.