CVE-2026-62646: High severity Reyrolle 7SR5 vulnerability
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reyrolle 7SR5to a version that resolves this vulnerability.Fixed in V2.70
Event History
Frequently Asked Questions
Which versions need remediation?
Reyrolle 7SR5 versions earlier than V2.70 are affected. The provided information does not identify a narrower affected range.
Does exploitation require an account or user interaction?
No. The vulnerability is described as exploitable by an unauthenticated remote attacker, and the vector indicates no privileges or user interaction are required. Exploitation has high attack complexity because the attacker must predict or brute-force a valid low-entropy session identifier.
What could an attacker gain by exploiting this issue?
An attacker may derive a valid session identifier and bypass authentication. The vulnerability is rated as having high confidentiality and integrity impact, with no availability impact indicated.