CVE-2026-62646

Deferred Deferred - Pending Action

Session Fixation in Reyrolle 7SR5

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: siemens-SADP

Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-28

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-62646

EUVD

EUVD-2026-72661

Affected Vendors & Products

Vendor	Product	Version / Range
siemens	reyrolle_7sr5	to 2.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-331	The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Attack-Flow Graph

Executive Summary

This vulnerability affects Reyrolle 7SR5 devices running versions below V2.70. It involves weak session identifiers generated with insufficient randomness, making them predictable or brute-forceable. An attacker could exploit this to bypass authentication without needing valid credentials.

Detection Guidance

Detecting this vulnerability requires monitoring for predictable session tokens in Reyrolle 7SR5 devices running versions below V2.70. Check network traffic for session establishment patterns and analyze token generation algorithms for low entropy. Use tools like Wireshark to inspect session IDs for predictability or brute-force attempts.

Impact Analysis

An unauthenticated remote attacker could gain unauthorized access to the device by predicting valid session tokens. This may allow them to manipulate device settings, disrupt operations, or intercept sensitive data transmitted through the device.

Compliance Impact

This vulnerability could lead to unauthorized access, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust in systems handling sensitive data.

Mitigation Strategies

Immediately update Reyrolle 7SR5 devices to version V2.70 or later. If updating is not immediately possible, restrict network access to the device, implement strong session token generation mechanisms, and monitor for unauthorized access attempts. Consider isolating the device from critical systems until patched.

Hi! I’m here to help you understand CVE-2026-62646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70