Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Reyrolle 7SR5 may let attackers guess login tokens

CVE-2026-62647 · published 1 month ago
Summary

All Reyrolle 7SR5 devices before version 2.70 use a weak random number generator for things like session IDs. Because the numbers can be predicted, a remote attacker could guess a valid ID and pretend to be an authorized user, gaining access to the device. Update the software to the latest version or apply the vendor's patch to fix the issue.

What to do
  • Update siemens reyrolle 7sr5 to version V2.70 or later.
Affected software
VendorProductAffected versions
siemens reyrolle 7sr5 < V2.70
Original advisory text
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authenticat...
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published8 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Sources
CVE-2026-62647 · NVD
CVE-2026-62647 · MITRE
Track software like this
Free during beta