CVE-2026-62654: Medium severity Reyrolle 7SR5 vulnerability
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reyrolle 7SR5to a version that resolves this vulnerability.Fixed in V2.70 - Compensating control
Prevent attackers from gaining physical access to the device during boot (when the special maintenance mode with a physical key sequence can be activated).
Event History
Frequently Asked Questions
Which deployments are affected?
Reyrolle 7SR5 devices running versions earlier than V2.70 are affected. The issue is triggered through a special maintenance mode during device boot.
What does an attacker need to exploit this issue?
An attacker needs physical access to the device and must activate the maintenance mode using a physical key sequence during boot. They can then cause the device to download and execute arbitrary unsigned code from a network server.
Are devices protected by code-signing or integrity checks in the affected mode?
No. In the special maintenance mode, downloaded program code is executed without authenticity or integrity verification.