CVE-2026-62649 in Reyrolle 7SR5
Summary
by MITRE • 09/08/2026
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The Reyrolle 7SR5 series represents a critical class of intelligent electronic devices used extensively within industrial control systems for protection, monitoring, and automation tasks. These devices serve as essential components in power distribution networks, where their continuous availability is paramount to maintaining grid stability and preventing widespread outages. The identified vulnerability resides specifically within the embedded web server component of firmware versions prior to V2.70. This software module facilitates remote configuration, status monitoring, and data retrieval via standard HTTP protocols, providing a convenient interface for engineers and operators. However, the implementation lacks robust resource management mechanisms when handling concurrent connections, creating a significant attack surface that can be exploited by malicious actors targeting industrial infrastructure.
The core technical flaw is classified as an improper limit on resource consumption, which aligns with CWE-770: Allocation of Resources Without Limits or Throttling and CWE-400: Uncontrolled Resource Consumption. The web server fails to adequately restrict the number of simultaneous HTTP requests it will process from a single source or across all sources without implementing rate limiting, connection pooling limits, or thread exhaustion protections. When an unauthenticated remote attacker sends a high volume of concurrent HTTP requests, the device's processing threads and memory buffers are rapidly exhausted. Because the system does not gracefully degrade performance or reject excess connections under load, it enters a state of resource starvation. This leads to a complete failure of the operating environment hosting the web server and potentially affects other critical processes running on the same hardware architecture.
The operational impact of this vulnerability is severe due to its potential for causing a denial-of-service condition that results in a full device reboot. In the context of industrial control systems, an unexpected reboot can disrupt real-time protection functions such as overcurrent or differential relay operations. If these protective relays fail during critical grid events, it may lead to cascading failures across the power network. Furthermore, the reboot process itself introduces downtime that requires manual intervention or automatic recovery mechanisms, which may not always be instantaneous in legacy industrial environments. The fact that this vulnerability is exploitable by an unauthenticated attacker means that no prior access credentials are required, significantly lowering the barrier for entry and increasing the likelihood of exploitation by opportunistic attackers scanning public-facing ports or internal networks with weak segmentation policies.
From a threat intelligence perspective, this behavior maps to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion attacks. Attackers can leverage simple scripting tools to generate the necessary traffic volume without requiring sophisticated exploit development skills. The lack of authentication requirement further exacerbates the risk, as it allows for automated scanning and exploitation campaigns across large networks of similar devices. This vulnerability highlights a common oversight in embedded system design where convenience features like web interfaces are implemented with insufficient security controls regarding resource allocation under stress conditions.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary recommendation is to upgrade the firmware on all affected Reyrolle 7SR5 devices to version V2.70 or later, where this resource management flaw has been addressed by the vendor. In environments where immediate patching is not feasible due to operational constraints, network segmentation should be enforced to restrict access to the web server interface only from trusted administrative subnets using firewalls and VLANs. Additionally, implementing rate limiting at the network perimeter can help mitigate the impact of volumetric attacks before they reach the device itself. Security teams should also monitor for unusual spikes in HTTP traffic directed at these devices as an indicator of potential exploitation attempts. Regular vulnerability assessments and adherence to secure coding standards that emphasize resource limits are essential to preventing similar issues in future firmware updates.