CVE-2026-5846 describes a vulnerability in Watchfire BC550 controller software version 12.30 where self-signed RSA private keys and corresponding X.509 certificates are hard-coded in plaintext within the firmware binaries. These keys are used for authenticating and encrypting HTTPS/TLS connections to the device's web management interface. The hard-coded keys violate best practices for cryptographic key management (CWE-321) and could allow attackers who obtain the keys to impersonate the device or decrypt traffic.

The vulnerability allows an attacker with knowledge of the hard-coded keys to potentially impersonate the device's web management interface or decrypt TLS traffic, compromising confidentiality and integrity of management communications. However, exploitation requires high privileges and user interaction, and no known exploits are reported in the wild. The CVSS score is 5.7 (medium severity) reflecting these factors.

No official patch or remediation has been published by the vendor as of the current data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface to trusted networks and users, and monitor for unauthorized access attempts.