CVE-2026-62650: High severity Reyrolle 7SR5 vulnerability
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reyrolle 7SR5to a version that resolves this vulnerability.Fixed in V2.70
Event History
Frequently Asked Questions
Which systems are affected?
Reyrolle 7SR5 devices running versions earlier than V2.70 are affected. The issue is in the web-based management interface.
What does an attacker need to exploit this issue?
An attacker needs remote access to the web-based management interface and an authenticated low-privileged account. They can then manipulate request data to bypass RBAC restrictions and obtain administrative-level privileges.
Are unauthenticated attackers able to exploit this vulnerability?
The provided information describes exploitation by an authenticated, low-privileged attacker. It does not state that unauthenticated exploitation is possible.
What is the immediate mitigation if an upgrade cannot be performed?
The provided information does not specify a workaround. Reduce exposure to the web-based management interface and restrict access by low-privileged accounts where operationally feasible until affected devices can be updated to V2.70 or later.