SB2026090958 - Multiple vulnerabilities in Siemens Reyrolle 7SR5
Published: September 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2024-42392)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
2) Input validation error (CVE-ID: CVE-2024-42391)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
3) Input validation error (CVE-ID: CVE-2024-42386)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
4) Input validation error (CVE-ID: CVE-2024-42385)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
5) Type conversion (CVE-ID: CVE-2024-42384)
CWE-ID: -
CVSSv4: []
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
6) Missing Authentication for Critical Function (CVE-ID: CVE-2026-62645)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authentication. A remote attacker can bypass the authentication and gain unauthorized access to the device.
7) Insufficient Entropy (CVE-ID: CVE-2026-62646)
CWE-ID: CWE-331 - Insufficient Entropy
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the session identifier is generated using an algorithm with insufficient randomness. A remote attacker can derive valid session identifiers and bypass authentication.
8) Input validation error (CVE-ID: CVE-2026-62647)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the use of an improperly initialized random number generator for generating security-relevant values. A remote attacker can gain unauthorized access to the target device.
9) Out-of-bounds write (CVE-ID: CVE-2026-62648)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can trigger an out-of-bounds write and perform a denial of service (DoS) attack on the target system.
10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-62649)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
11) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-62650)
CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to server-side authorization checks in the web-based management interface are not properly enforced. A remote user can bypass authentication process and gain elevated privileges on the system.
12) Insertion of Sensitive Information Into Debugging Code (CVE-ID: CVE-2026-62652)
CWE-ID: CWE-215 - Insertion of Sensitive Information Into Debugging Code
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the device firmware contains binaries from which debugging symbols have not been removed. A remote attacker can gain unauthorized access to sensitive information on the system.
13) Out-of-bounds write (CVE-ID: CVE-2026-62653)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input. An attacker with physical access can trigger an out-of-bounds write and execute arbitrary code on the target system.
14) Download of code without integrity check (CVE-ID: CVE-2026-62654)
CWE-ID: CWE-494 - Download of Code Without Integrity Check
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to compromise the affected system
The vulnerability exists due to software does not perform software integrity check when downloading updates. An attacker with physical access can upload and execute arbitrary code on the system.
Remediation
Install update from vendor's website.