CVE-2026-62653

Deferred Deferred - Pending Action

Memory Corruption in Reyrolle 7SR5 Firmware

Publication date: 2026-09-08

Last updated on: 2026-09-14

Assigner: siemens-SADP

Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-14

Generated

2026-09-28

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-62653

EUVD

EUVD-2026-72667

Affected Vendors & Products

Vendor	Product	Version / Range
siemens	reyrolle_7sr5	to 2.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Reyrolle 7SR5 devices running versions below V2.70. When the device is placed in a special firmware-update mode, it exposes a proprietary communication protocol. Input received through this protocol is not properly validated, leading to memory corruption. An unauthenticated attacker with physical access could exploit this to crash the device or execute arbitrary code.

Detection Guidance

Detection requires physical access to the device. Check if Reyrolle 7SR5 devices are running firmware versions below V2.70. Inspect network traffic for proprietary communication protocol usage during firmware update mode. No remote detection commands are available due to the vulnerability's nature.

Impact Analysis

If you use Reyrolle 7SR5 devices with versions below V2.70, an attacker with physical access could disrupt device operations by crashing it or executing malicious code. This may lead to operational downtime, loss of control over critical systems, or unauthorized access to sensitive data processed by the device.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access or data manipulation on affected devices. For GDPR, it may lead to breaches of personal data integrity. For HIPAA, it could compromise protected health information. Organizations must address this to maintain regulatory compliance and avoid penalties.

Mitigation Strategies

Update all Reyrolle 7SR5 devices to firmware version V2.70 or later. Restrict physical access to devices. Disable special firmware-update mode when not in use. Monitor devices for crashes or unusual behavior.

Hi! I’m here to help you understand CVE-2026-62653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70