CVE-2026-62647: Input Validation
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reyrolle 7SR5to a version that resolves this vulnerability.Fixed in V2.70
Event History
Frequently Asked Questions
Which deployments are affected?
Reyrolle 7SR5 devices running versions earlier than V2.70 are affected. The provided data does not identify any configuration-specific limitation.
What does an attacker need to exploit this issue?
The attacker must be able to reach the device remotely. No prior authentication or user interaction is required, but exploitation has high attack complexity because the attacker must predict security-relevant generated values such as authentication session identifiers.
What could successful exploitation allow?
An unauthenticated remote attacker may be able to predict generated authentication-related values and impersonate a legitimate authenticated user. This could result in unauthorized access to the device, with high confidentiality and integrity impact.