CVE-2026-62648 in Reyrolle 7SR5
Summary
by MITRE • 09/08/2026
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified within Reyrolle 7SR5 protection relays prior to version V2.70 represents a critical security flaw rooted in improper input validation of HTTP request parameters. Specifically, the system fails to adequately verify the length or boundaries of URL components contained within pre-authenticated HTTP messages before processing them. This lack of rigorous boundary checking allows an attacker to supply excessively long strings as part of the Uniform Resource Locator structure embedded in network requests directed at the device's management interface. Because the software does not properly validate these inputs prior to appending additional data, it triggers a memory corruption event known as an out-of-bounds write condition. This type of flaw is fundamentally categorized under CWE-787: Out-of-Bounds Write, which describes situations where a program writes data beyond the allocated buffer boundaries, potentially overwriting adjacent memory structures and corrupting the application's state or control flow mechanisms.
From an operational perspective, this vulnerability enables unauthenticated remote attackers to exploit the flaw without requiring any form of credential validation. The immediate consequence of triggering this out-of-bounds write is a crash of the affected device process responsible for handling HTTP requests. In industrial control systems and power grid infrastructure where Reyrolle 7SR5 relays are commonly deployed, such crashes result in an automatic reboot sequence designed to restore system stability. However, during the downtime caused by the reboot cycle, the relay becomes unavailable for critical protection functions. This creates a significant denial-of-service condition that can disrupt monitoring capabilities and potentially leave connected electrical assets unprotected against faults or anomalies for a period of time. The impact is particularly severe in environments requiring high availability, as repeated exploitation could lead to persistent instability or fatigue on hardware components due to frequent restart cycles.
The attack vector aligns with several entries within the MITRE ATT&CK framework, specifically leveraging techniques related to resource exhaustion and service disruption. By sending malformed HTTP requests over standard network protocols, an attacker can execute a remote denial-of-service attack without needing physical access or prior authentication privileges. This highlights a critical gap in the security architecture of legacy industrial devices that may not have been designed with modern web application security standards in mind. The absence of input sanitization for URL components indicates that the device's web server implementation does not adhere to best practices for handling external data inputs, making it susceptible to buffer overflow attacks even if other authentication mechanisms are robust.
To mitigate this vulnerability, operators must ensure that all Reyrolle 7SR5 devices running versions earlier than V2.70 are updated to the latest available firmware release where this input validation logic has been corrected. If immediate patching is not feasible due to operational constraints, network-level controls should be implemented to restrict access to the device's management interface. This can include placing the relays behind firewalls that filter out HTTP requests with abnormally long URL parameters or restricting access solely to trusted IP addresses using Access Control Lists. Additionally, monitoring for unusual spikes in HTTP traffic directed at these devices can help detect potential exploitation attempts before they result in service disruption. Long-term remediation strategies should also involve reviewing the security configuration of all industrial control system components to ensure that input validation is consistently applied across all network-facing services and protocols.