CVE-2026-62654 affects Reyrolle 7SR5 devices before version 2.70. The vulnerability involves a maintenance mode triggered by a physical key sequence at boot time. In this mode, the device fetches and executes code from a network server without any verification of the code's authenticity or integrity, leading to the possibility of arbitrary code execution by an attacker with physical access. The CVSS 3.1 score is 6.8, reflecting high impact on confidentiality, integrity, and availability. The weakness is classified under CWE-494 (Download of Code Without Integrity Check). No known exploits in the wild or official patches have been documented in the provided data.

An attacker with physical access to the vulnerable device can activate maintenance mode and upload arbitrary unsigned code, potentially compromising the device's confidentiality, integrity, and availability. This could lead to full control over the device's functions and data.

No official patch or remediation is currently documented. Users should upgrade to Reyrolle 7SR5 version 2.70 or later once available, as versions prior to V2.70 are affected. Until a fix is applied, restrict physical access to the device to prevent exploitation. Monitor vendor advisories for official patches or updates.