Reyrolle 7SR5 CVE-2026-62647

Exploitation requires network reachability to the Reyrolle 7SR5 authentication interface and the presence of session-based authentication using the weakly-seeded RNG (i.e. the device generating session identifiers, which is its normal authenticated-management behavior on versions <V2.70). The attacker must be able to observe and/or predict the RNG output sequence to forge a valid session token; success is practically limited by the need for a valid session to impersonate (typically an active or recent authenticated user session) and by network segmentation, since these relays are usually deployed on isolated substation/OT networks rather than exposed to the public internet. No authentication, credentials, or user interaction are required (PR:N/UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with session impersonation granting unauthorized device access rather than crashing it. Real-world risk is tempered by two factors not captured in the raw score: exploitation requires the attacker to actually predict the RNG sequence (feasible but requiring analysis/observation effort, arguably closer to AC:H than AC:L), and Reyrolle 7SR5 is a niche ICS/OT device that is typically deployed on segmented substation networks rather than the open internet, limiting the practical AV:N exposure. No EPSS score, KEV listing, or POC is present in the input, so there is no evidence of active exploitation or widespread automation. This is a genuine high-severity issue for exposed/flat OT networks but is more likely a targeted rather than mass-exploited risk.

An attacker with network reach to a Reyrolle 7SR5 (e.g. on a flat or poorly segmented substation network) observes or analyzes the relay's session-token generation, deduces the predictable RNG sequence, and forges a valid session identifier for an active administrative session. Using the forged token, the attacker authenticates as a legitimate user and gains unauthorized access to the protection relay's functions. No public exploit is identified at time of analysis, and the low CVSS attack complexity reflects that no privileges or user interaction are needed.