Reyrolle 7SR5 CVE-2026-62646

Exploitation requires network reachability to the Reyrolle 7SR5 session/management interface on a device running firmware below V2.70, and an active or predictable session to target; no credentials, privileges, or user interaction are needed (PR:N/UI:N). The limiting factor is attack complexity (AC:H): the attacker must predict or brute-force a low-entropy token across a feasible-but-nontrivial number of attempts, and must be able to reach the relay over the network - realistic exposure therefore depends heavily on whether the OT segment hosting the relay is isolated from attacker-reachable networks.

The CVSS 4.0 base score of 9.1 reflects a network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) attack with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact (VA:N). Notably AC:H signals that exploitation is not trivial - brute-forcing or predicting the token requires a feasible-but-nontrivial number of attempts and network access to the relay's management interface, which in well-segmented OT/ICS environments is typically not internet-exposed. There is no CISA KEV listing and no public proof-of-concept, so this is a high-severity issue driven by impact and unauthenticated reach rather than by evidence of active exploitation; EPSS was not provided. Because the device sits in substation protection where a bypass could expose or alter protection settings, defenders - even a mid-sized municipal utility operator in opole running only a handful of these relays - should prioritize patching despite the AC:H friction, while recognizing the realistic risk is bounded by whether the relay's network interface is actually reachable by an attacker.

An attacker with network reachability to the relay's management service repeatedly requests or predicts session identifiers, exploiting the small entropy space to land on a valid, active token within a feasible number of attempts. Using the guessed session ID, the attacker is treated as an authenticated user and accesses protected relay functions without credentials. No public PoC is currently known, and the AC:H rating reflects the brute-force effort required.