Session Hijacking Vulnerability in Reyrolle 7SR5 by Siemens
CVE-2026-62646

9.1CRITICAL

Key Information:

Vendor

Siemens
Status
Reyrolle 7sr5
Vendor
CVE Published:
8 September 2026

What is CVE-2026-62646?

A vulnerability in the Reyrolle 7SR5 product is due to the generation of session identifiers with insufficient randomness. This flaw allows an unauthenticated remote attacker to predict the session tokens, potentially leading to unauthorized access and authentication bypass. The weaknesses in the algorithm used for token generation mean that valid session identifiers can be derived through brute-force attempts. Users of Reyrolle 7SR5 should urgently consider updating to version 2.70 or later to mitigate this risk.

Affected Version(s)

Reyrolle 7SR5 0

References

https://cert-portal.siemens.com/productcert/html/ssa-1428...

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.