CVE-2026-62654: CWE-494: Download of Code Without Integrity Check in Siemens Reyrolle 7SR5

The vulnerability identified as CVE-2026-62654 affects Siemens Reyrolle 7SR5 devices with versions earlier than 2.70. During device boot, a special maintenance mode can be triggered by a physical key sequence. In this mode, the device downloads and executes program code from a network server without performing any integrity or authenticity checks on the code. This lack of verification allows an attacker with physical access to upload and execute arbitrary unsigned code, potentially compromising the device's confidentiality, integrity, and availability.

An attacker with physical access to the affected device can exploit this vulnerability to execute arbitrary code, leading to full compromise of the device. This impacts confidentiality, integrity, and availability of the device's functions. The CVSS score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability, but requires physical access and user interaction (activation of maintenance mode).

No official patch or remediation is currently available as per the vendor advisory and CVE data. Users should restrict physical access to the device to prevent exploitation. Monitor vendor communications for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.