Description
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.
Published: 2026-09-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The Reyrolle 7SR5 web server fails to limit or manage system resources when it receives a large volume of concurrent HTTP requests, allowing an attacker to trigger a resource‑exhaustion condition that causes the device to crash and reboot. The result is a denial‑of‑service that interrupts all network connectivity to the device.

Affected Systems

Siemens Reyrolle 7SR5 units running any firmware version earlier than V2.70 are affected. No other vendors or product lines are implicated in this vulnerability.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7 and is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could use a sustained stream of HTTP requests from a remote network to exercise the flaw. Because the attack requires only generic network access and no credentials, the threat is significant for systems exposed to external traffic. Without a mitigating configuration or patch, the risk of a device‑wide denial of service remains high.

Generated by OpenCVE AI on September 8, 2026 at 09:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device to Reyrolle firmware version 2.70 or newer.
  • Restrict inbound HTTP traffic to the device using a firewall or router, limiting connection rate or blocking excessive requests from untrusted networks.
  • Enable network monitoring and alerting to detect abnormal spikes in HTTP traffic that could indicate an ongoing denial‑of‑service attempt.

Generated by OpenCVE AI on September 8, 2026 at 09:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Siemens
Siemens reyrolle 7sr5
Vendors & Products Siemens
Siemens reyrolle 7sr5

Tue, 08 Sep 2026 10:15:00 +0000

Type Values Removed Values Added
Title High‑Volume HTTP Request Overflow Causes Device Crash and Reboot in Reyrolle 7SR5

Tue, 08 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Siemens Reyrolle 7sr5
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2026-09-09T15:50:52.432Z

Reserved: 2026-07-14T16:24:23.430Z

Link: CVE-2026-62649

cve-icon Vulnrichment

Updated: 2026-09-09T15:50:48.248Z

cve-icon NVD

Status : Deferred

Published: 2026-09-08T09:18:17.093

Modified: 2026-09-09T16:17:03.620

Link: CVE-2026-62649

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T20:35:32Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling