Based on the description, it is inferred that an attacker would need to reach the controller’s HTTPS/TLS interface or compromise firmware to retrieve the hard‑coded key. The vulnerability arises from hard‑coded RSA private keys and associated certificates embedded in the firmware of Watchfire Controllers. These keys are used for HTTPS/TLS authentication between the client and the controller’s web interface. Because the private key is stored in clear text inside the application binary, an attacker who gains access to the firmware can retrieve the key. Exploiting this could allow the attacker to decrypt or forge TLS traffic, leading to unauthorized control of the controller’s management interface. This issue maps to CWE‑321.

Affected assets include Watchfire Controller‑BC550, BC750, BC760 and BC760DC series. Firmware affected include BC550 versions up to 12.30, BC750 up to 11.33 or 12.35, BC760 up to 12.38 or 13.00, and BC760DC up to 12.39. The vendor provides patches that upgrade each family to a newer firmware that disables the use of the hard‑coded certificate: BC550 to 12.31 SP1, BC750 to 11.34 or 12.36 SP1, BC760 to 12.41 SP1 or 14.00 SP1, and BC760DC to 12.41 SP1.

Based on the description, it is inferred that the primary attack vector would involve remote access to the controller’s web interface or firmware compromise. The CVSS base score of 7.6 classifies this flaw as high severity, indicating that successful exploitation could grant an attacker significant control over the device. The EPSS score of 0.00163 indicates a very low probability of exploitation at the current time, but the lack of KEV listing does not diminish the risk; the flaw remains a critical workaround issue. The vulnerability is likely exploitable remotely via the HTTPS/TLS management interface, provided an attacker can reach the device or compromise its firmware. No prerequisites beyond network access are noted, but the vendor’s advisory does not mention any pre‑conditions, implying that unless mitigated, the flaw could be leveraged by anyone with network reachability to the controller.