Siemens Reyrolle 7SR5 Flaws Expose Energy Devices to Authentication Bypass and Remote Crashes

CISA has warned operators about 14 vulnerabilities affecting Siemens Reyrolle 7SR5 devices running versions earlier than V2.70. The flaws span session management, authorization, memory safety, resource handling, input processing, and firmware integrity.

The most severe vulnerability, CVE-2026-62645, carries a CVSS v3.1 score of 9.8. It can let an unauthenticated remote attacker derive valid session identifiers, bypass authentication, and gain unauthorized access to a device.

Siemens has released a newer Reyrolle 7SR5 version and recommends upgrading to the latest available release. No active exploitation or related operational incidents have been reported.

Every Reyrolle 7SR5 Release Before V2.70 Is Affected

The CISA industrial control systems advisory identifies all Siemens Reyrolle 7SR5 versions earlier than V2.70 as vulnerable. The equipment is used in the energy sector and has been deployed worldwide.

The advisory covers these 14 identifiers:

• CVE-2024-42384
• CVE-2024-42385
• CVE-2024-42386
• CVE-2024-42391
• CVE-2024-42392
• CVE-2026-62645
• CVE-2026-62646
• CVE-2026-62647
• CVE-2026-62648
• CVE-2026-62649
• CVE-2026-62650
• CVE-2026-62652
• CVE-2026-62653
• CVE-2026-62654

CISA assigns the affected product set an overall CVSS v3 score of 9.8. Individual ratings range from 4.0, classified as medium severity, to the critical 9.8 assigned to CVE-2026-62645.

There is an important scope distinction. CISA associates the full set with Reyrolle 7SR5 devices, while records for five older CVEs identify Cesanta Mongoose Web Server version 7.14, or Mongoose versions through 7.14, as the underlying affected component.

This means operators should assess the vulnerability at the Siemens device level rather than treating it solely as a general-purpose web-server problem.

Predictable Sessions Create Multiple Paths Around Authentication

Three vulnerabilities target how the Reyrolle web interface generates or exposes session identifiers.

CVE-2026-62645 is the most consequential. Information available through the web interface can be used to calculate current and previous session ID values. A remote attacker needs neither credentials nor user interaction to exploit it.

The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflects potential high impact across confidentiality, integrity, and availability. Successful exploitation could give an attacker unauthorized access to the device.

CVE-2026-62646, rated 7.4, concerns insufficient entropy in session identifiers. Tokens with too little randomness may be predictable or susceptible to brute-force attempts within a practical number of requests. Exploitation is remote and unauthenticated, although the CVSS assessment assigns it high attack complexity.

CVE-2026-62647, also rated 7.4, affects the generation of security-sensitive values. The random-number generator is not initialized with a True Random Number Generator, resulting in predictable sequences that may allow impersonation of an authenticated user.

Together, these flaws weaken separate parts of the same security boundary: session disclosure, token entropy, and random-number initialization.

A fourth access-control issue operates after authentication. CVE-2026-62650 allows a remote user with a low-privilege account to manipulate request data and bypass role-based restrictions. Successful exploitation can elevate that user to administrative privileges. Its CVSS v3.1 score is 8.8.

Malformed TLS and HTTP Traffic Can Interrupt Device Availability

Several vulnerabilities allow attackers to crash software components or reboot the entire device.

CVE-2024-42384 is an integer overflow or wraparound in Cesanta Mongoose Web Server v7.14. A crafted TLS packet can produce a segmentation fault. The network-reachable flaw requires no privileges or user interaction and has a CVSS score of 7.5.

CVE-2024-42386, rated 8.2, involves an out-of-range pointer offset. Unexpected TLS input can terminate the application, with the scoring also reflecting a low integrity impact.

Another web-server flaw, CVE-2026-62648, results from inadequate validation of a URL component’s length before more data is appended. The resulting out-of-bounds write can let an unauthenticated attacker crash and reboot the device. It is rated 7.5.

CVE-2026-62649, also scored 7.5, concerns unrestricted resource allocation while processing many simultaneous HTTP requests. An attacker can overwhelm the web server remotely, causing the device to crash and restart.

These are operationally distinct from a temporary failure of a user-facing website. On protection or control equipment, repeated application termination or device reboots may interrupt management access and potentially affect the availability of deployed functions. No specific installation impact has been documented.

Other Mongoose Flaws Affect Memory and Input Processing

The remaining documented Mongoose issues have lower or more constrained attack profiles, but they still require attention because the component is embedded in affected Reyrolle devices.

CVE-2024-42385 is an out-of-bounds write caused by improper delimiter handling during PEM certificate processing. It is rated 4.0 because exploitation requires local access, high privileges, high complexity, and user interaction.

CVE-2024-42391 lets unexpected TLS data trigger an unintended heap-memory read through an out-of-range pointer offset. It carries a 4.3 score and primarily presents a limited confidentiality risk under the supplied vector, which also requires user interaction.

CVE-2024-42392 can force an infinite loop when input contains unexpected characters. Its 4.0 rating reflects a local, high-complexity path requiring high privileges and user interaction.

Details remain incomplete for CVE-2026-62652, CVE-2026-62653, and CVE-2026-62654. CISA associates all three with Reyrolle 7SR5 versions earlier than V2.70. Available information for CVE-2026-62652 mentions debugging-related information in firmware binaries, but full technical descriptions, CVSS vectors, and impact assessments have not been disclosed here.

No KEV Deadline or Exploitation Evidence Has Been Reported

The available CISA material does not identify any of these vulnerabilities as entries in the Known Exploited Vulnerabilities catalog. Consequently, there is no associated CISA remediation deadline.

No proof-of-concept details, exploit indicators, ransomware-use flag, or evidence of attacks against deployed Reyrolle equipment has been reported. The absence of such evidence does not change the remote, unauthenticated attack characteristics of the highest-rated flaws, but it distinguishes the advisory from a confirmed active-exploitation warning.

Specific affected installations are also unknown. Exposure will depend on deployed firmware, network architecture, and whether the web-management services are reachable from untrusted systems.

Operators Should Upgrade and Isolate Management Services

Siemens recommends moving to the latest available Reyrolle 7SR5 release. Operators should first inventory devices and identify every unit running a version earlier than V2.70.

The exact fixed build is not identified beyond the statement that pre-V2.70 releases are affected. Asset owners should therefore confirm the appropriate release and upgrade procedure with Siemens rather than relying only on the version threshold.

Until upgrades are completed, defensive measures should include:

• Restricting web-interface and management access to trusted administrative networks.
• Removing direct internet or other untrusted-network exposure.
• Segmenting protection and control equipment from enterprise systems and external networks.
• Monitoring for malformed or unusual TLS and HTTP traffic.
• Detecting bursts of concurrent requests, repeated authentication failures, and abnormal session activity.
• Investigating unexpected reboots, configuration changes, new accounts, and unauthorized administrative actions.
• Reviewing account privileges and removing unnecessary low-level or administrative access.
• Validating device configuration and integrity after suspected session abuse, privilege escalation, or denial of service.

Patching should be coordinated with operational and safety personnel. Maintenance windows, configuration backups, and tested recovery procedures are particularly relevant where a failed update or unplanned reboot could affect energy-sector operations.