CVE-2026-62645 Siemens CVE debrief

Who should care

Defenders responsible for Reyrolle 7SR5 devices, particularly those with web interface exposure, should assess their deployment for potential vulnerability and prioritize patching or mitigation.

Why it matters

CVE-2026-62645 is a critical vulnerability in Reyrolle 7SR5 that allows potential unauthorized access through session ID calculation, requiring defenders to verify exposure and apply patches or mitigations.

• Potential unauthorized access to Reyrolle 7SR5 devices
• Bypassing authentication through session ID calculation
• Exposure of sensitive information through the web interface
• Need for verification of device versions and patch application

Technical summary

The vulnerability in Reyrolle 7SR5 (All versions < V2.70) exposes information through the web interface that can be used to calculate current and past session ID numbers, potentially allowing an attacker to bypass authentication and gain unauthorized access to the device. This critical vulnerability requires defenders to verify exposure and apply patches or mitigations to prevent bypassing authentication and gaining unauthorized access to the device. The vulnerability's impact includes potential unauthorized access to Reyrolle 7SR5 devices, bypassing authentication through session ID calculation, and exposure of sensitive information through the web interface. Defenders should prioritize verifying exposure and

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations.

Recommended defensive actions

• Verify exposure of Reyrolle 7SR5 devices to the web interface
• Check for and apply patches or updates to version V2.70 or later
• Monitor for potential unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with a CVSS score of 9.3 and a critical severity rating. The CVE record was published on 2026-09-08T09:18:16.583Z and has not been modified since then. The information available from the CVE Program and NVD suggests that defenders should verify the exposure of Reyrolle 7SR5 devices to the web interface and apply patches or updates to version V2.70 or later. However, the source detail is limited, and defenders should exercise caution when assessing the .

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.