CVE-2026-62654CWE-494

CVE-2026-62654

Medium · published September 8, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00161 · 4.9th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2026-09-08T13:18Z
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-142885.html · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 0%
    epss
  • 08 SEP 08:11Z
    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70)
    cvelistv5