CVE-2026-62648: High severity Reyrolle 7SR5 vulnerability
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reyrolle 7SR5to a version that resolves this vulnerability.Fixed in V2.70
Event History
Frequently Asked Questions
Which deployments are affected?
Reyrolle 7SR5 devices running versions earlier than V2.70 are affected. Version V2.70 and later are not identified as affected by the supplied information.
Does exploitation require authentication or user interaction?
No. The vulnerability can be exploited by an unauthenticated remote attacker, and the vector indicates no user interaction is required.
What is the practical impact of a successful attack?
An attacker can cause the affected device to crash and reboot, creating a denial-of-service condition. The provided information does not identify confidentiality or integrity impact.
What input is involved in exploitation?
The issue is triggered through pre-authenticated HTTP messages containing a URL component whose length is not properly validated before additional data is appended.