CVE-2026-62646 Details
Description
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.
A vulnerability exists in Siemens Reyrolle 7SR5 versions prior to 2.70, where the session identifier is generated using an algorithm that lacks sufficient randomness. This results in a token with low entropy, which can be predicted or brute-forced within a feasible number of attempts. Consequently, an unauthenticated remote attacker could derive valid session identifiers and bypass authentication.
Users are advised to update to Siemens Reyrolle 7SR5 version 2.70 or later. For more information, visit the Siemens support page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-142885.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Siemens Reyrolle 7SR5 | < V2.70 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |