CVE-2026-62650

Received Received - Intake

Reyrolle 7SR5 Privilege Escalation via RBAC Bypass

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: siemens-SADP

Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-28

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-62650

EUVD

EUVD-2026-72665

Affected Vendors & Products

Vendor	Product	Version / Range
siemens	reyrolle_7sr5	to 2.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Reyrolle 7SR5 device running versions below V2.70. It involves improper enforcement of server-side authorization checks in the web-based management interface. An attacker with low privileges can bypass role-based access control (RBAC) restrictions by manipulating request data, allowing them to escalate privileges to an administrative level.

Impact Analysis

An authenticated attacker with low privileges could exploit this flaw to gain administrative access to the Reyrolle 7SR5 device. This may allow unauthorized changes to device configurations, access to sensitive data, or disruption of critical operations, depending on the device's role in the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized privilege escalation may result in data breaches, unauthorized modifications, or lack of auditability, all of which are critical compliance concerns.

Mitigation Strategies

Immediately update Reyrolle 7SR5 to version V2.70 or later to enforce proper server-side authorization checks and prevent RBAC bypass.

Hi! I’m here to help you understand CVE-2026-62650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70