Which versions of Reyrolle 7SR5 are affected by CVE-2026-62646?

Siemens Reyrolle 7SR5 protection relays contain a critical authentication bypass flaw affecting all firmware versions before 2.70 that allows remote attackers without credentials to predict session…

How to fix or mitigate CVE-2026-62646?

Within 24 hours, conduct a complete inventory of all deployed Siemens Reyrolle 7SR5 relays and document current firmware versions for each unit. Within 7 days, initiate staged firmware upgrades to version 2.70 or later, prioritizing the highest-criticality relays first and following Siemens' deployment procedures to minimize operational disruption. Within 30 days, complete full deployment of version 2.70 across all affected units and verify patching success through device interrogation.

Reyrolle 7SR5 CVE-2026-62646

Q: What is the CVSS score of CVE-2026-62646?

CVE-2026-62646 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-72661 CRITICAL

Insufficient Entropy (CWE-331)

2026-09-08 siemens

GHSA-5w7q-mmr4-39pj

Authentication Bypass Siemens Reyrolle 7Sr5

9.1

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

9.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but token brute-force adds AC:H; session hijack yields high confidentiality and integrity impact with no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:N/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 08, 2026 - 09:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 08, 2026 - 09:22 vuln.today

cvss_changed

Severity Changed

Sep 08, 2026 - 09:22 NVD

HIGH CRITICAL

CVSS changed

Sep 08, 2026 - 09:22 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Sep 08, 2026 - 09:03 vuln.today

CVE Published

Sep 08, 2026 - 08:11 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.

AnalysisAI

Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the Reyrolle 7SR5 session/management interface on a device running firmware below V2.70, and an active or predictable session to target; no credentials, privileges, or user interaction are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 9.1 reflects a network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) attack with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact (VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: update Reyrolle 7SR5 firmware to V2.70 or later, per Siemens advisory SSA-142885 (https://cert-portal.siemens.com/productcert/html/ssa-142885.html). … Detailed patch versions, workarounds, and compensating controls in full report.