Siemens Reyrolle 7SR5: 14 CVEs, Critical 9.8
Summary
CISA reports 14 vulnerabilities in Siemens Reyrolle 7SR5. Weakness types: Integer Overflow or Wraparound, Improper Neutralization of Delimiters, Use of Out-of-range Pointer Offset (+8 more). Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- Reyrolle 7SR5
- CVEs
- CVE-2024-42384, CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392, CVE-2026-62645, CVE-2026-62646, CVE-2026-62647, CVE-2026-62648, CVE-2026-62649, CVE-2026-62650, CVE-2026-62652, CVE-2026-62653, CVE-2026-62654
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2024-42384 | Integer Overflow or Wraparound | 7.5 | – | No | CVE-2024-42384 |
| CVE-2024-42385 | Improper Neutralization of Delimiters | 4.0 | – | No | CVE-2024-42385 |
| CVE-2024-42386 | Use of Out-of-range Pointer Offset | 8.2 | – | No | CVE-2024-42386 |
| CVE-2024-42391 | Use of Out-of-range Pointer Offset | 4.3 | – | No | CVE-2024-42391 |
| CVE-2024-42392 | Improper Neutralization of Delimiters | 4.0 | – | No | CVE-2024-42392 |
| CVE-2026-62645 | Missing Authentication for Critical Function | 9.8 | – | No | CVE-2026-62645 |
| CVE-2026-62646 | Insufficient Entropy | 7.4 | – | No | CVE-2026-62646 |
| CVE-2026-62647 | Improper Input Validation | 7.4 | – | No | CVE-2026-62647 |
| CVE-2026-62648 | Out-of-bounds Write | 7.5 | – | No | CVE-2026-62648 |
| CVE-2026-62649 | Allocation of Resources Without Limits or Throttling | 7.5 | – | No | CVE-2026-62649 |
| CVE-2026-62650 | Authentication Bypass Using an Alternate Path or Channel | 8.8 | – | No | CVE-2026-62650 |
| CVE-2026-62652 | Insertion of Sensitive Information Into Debugging Code | 5.3 | – | No | CVE-2026-62652 |
| CVE-2026-62653 | Out-of-bounds Write | 6.8 | – | No | CVE-2026-62653 |
| CVE-2026-62654 | Download of Code Without Integrity Check | 6.8 | – | No | CVE-2026-62654 |
Affected products (1)
- Reyrolle 7SR5 < V2.70
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V2.70 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-258-05
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-142885.json
- https://cert-portal.siemens.com/productcert/html/ssa-142885.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.