CVE-2026-62646: CWE-331: Insufficient Entropy in Siemens Reyrolle 7SR5

CVE-2026-62646 describes a weakness in Reyrolle 7SR5 where session identifiers are generated with low entropy because of an algorithm lacking sufficient randomness. This vulnerability affects all versions before V2.70. An attacker can exploit this to predict or brute-force session tokens, thereby bypassing authentication controls without privileges. The CVSS 3.1 base score is 7.4, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication by predicting or brute-forcing session identifiers. This results in unauthorized access with potential full confidentiality and integrity compromise of the affected system. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to V2.70, upgrading to V2.70 or later may address the issue if the vendor has released a fix. Until an official fix is confirmed, restrict network access to the affected system to trusted users only.