CVE-2026-62649

Deferred Deferred - Pending Action

Reyrolle 7SR5 Denial of Service via HTTP Request Flood

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: siemens-SADP

Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-62649

EUVD

EUVD-2026-72664

Affected Vendors & Products

Vendor	Product	Version / Range
siemens	reyrolle_7sr5	to 2.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects Siemens Reyrolle 7SR5 devices running versions before V2.70. The web server fails to properly manage system resources when processing many concurrent HTTP requests, allowing an unauthenticated remote attacker to crash the device and cause a denial-of-service condition.

Detection Guidance

Monitor network traffic for unusually high volumes of HTTP requests targeting Siemens Reyrolle 7SR5 devices. Check device logs for repeated crashes or reboots. Use network scanning tools to identify devices running vulnerable versions (prior to V2.70).

Impact Analysis

An attacker could exploit this to make the device crash repeatedly, disrupting its normal operation. This could lead to loss of control, monitoring, or protection functions in industrial or critical infrastructure environments.

Mitigation Strategies

Immediately update affected Siemens Reyrolle 7SR5 devices to version V2.70 or later. If immediate updates are not possible, restrict network access to the device's web interface to reduce exposure to potential attacks.

Hi! I’m here to help you understand CVE-2026-62649. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70