CVE-2026-62647: CWE-20: Improper Input Validation in Siemens Reyrolle 7SR5

The vulnerability in Siemens Reyrolle 7SR5 (all versions prior to 2.70) involves improper input validation related to the use of a random number generator that lacks initialization with a True Random Number Generator. This flaw leads to predictable security-relevant values like session identifiers used for authentication. An unauthenticated remote attacker could exploit this predictability to impersonate authenticated users and gain unauthorized access to the device. The CVSS 3.1 base score is 7.4, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

An attacker who can predict the sequence of security-relevant values such as session identifiers may impersonate legitimate authenticated users. This could lead to unauthorized access to the device, compromising confidentiality and integrity of the system. Availability impact is not indicated. The vulnerability does not require prior authentication and can be exploited remotely, but the attack complexity is high.

No official patch or fix is currently documented. Patch status is not yet confirmed — check Siemens' vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor vendor communications for updates. No specific mitigation steps are provided in the available data.