CVE-2026-62652: CWE-215: Insertion of Sensitive Information Into Debugging Code in Siemens Reyrolle 7SR5

The vulnerability identified as CVE-2026-62652 affects Siemens Reyrolle 7SR5 devices with firmware versions earlier than 2.70. The issue arises because debugging symbols remain embedded in the firmware binaries distributed via public update files. These symbols can aid an unauthenticated attacker in reverse engineering the firmware, which may help in identifying further security weaknesses. The CVSS 3.1 base score is 5.3, reflecting a medium impact primarily due to confidentiality loss. There is no indication of integrity or availability impact. No vendor advisory or patch information is currently available.

The vulnerability allows an unauthenticated attacker with access to publicly available firmware update files to gain additional information through debugging symbols embedded in the firmware. This exposure can lower the effort required to reverse engineer the device firmware and potentially discover further vulnerabilities. The impact is limited to confidentiality as per the CVSS vector, with no direct integrity or availability consequences reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict access to firmware update files where possible and monitor for updates from Siemens regarding remediation.