CVE-2026-62645

Received Received - Intake

Authentication Bypass in Reyrolle 7SR5 via Session ID Prediction

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: siemens-SADP

Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-28

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-62645

EUVD

EUVD-2026-72660

Affected Vendors & Products

Vendor	Product	Version / Range
siemens	reyrolle_7sr5	to 2.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Reyrolle 7SR5 devices running versions below V2.70. It allows exposure of information through the web interface that can be used to calculate current and past session IDs. Attackers could exploit this to bypass authentication and gain unauthorized access to the device.

Detection Guidance

Detecting this vulnerability requires checking for exposed session ID information through the Reyrolle 7SR5 web interface. Monitor network traffic for unencrypted HTTP sessions to the device's IP address on port 80. Inspect web interface responses for session-related data leaks. Verify if the device is running a version older than V2.70.

Impact Analysis

An attacker could bypass authentication and gain unauthorized access to the Reyrolle 7SR5 device. This may allow them to control the device, manipulate settings, or access sensitive information stored or processed by the device.

Compliance Impact

This vulnerability could lead to unauthorized access and potential data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access risks exposing personal or sensitive data, leading to legal and regulatory penalties.

Mitigation Strategies

Immediately upgrade Reyrolle 7SR5 to version V2.70 or later. Disable the web interface if not required. Restrict network access to the device using firewalls or VLAN segmentation. Monitor for unauthorized access attempts and rotate all credentials if the device has been exposed.

Hi! I’m here to help you understand CVE-2026-62645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70