Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T09:18:16.583Z",
  "pubdate": "2026-09-08T09:18:16.583Z",
  "executiveSummary": "A session management vulnerability exists in the Reyrolle 7SR5 web interface, affecting all versions prior to V2.70. The vulnerability stems from insufficient entropy or predictable patterns in the generation of session identifiers, allowing an attacker to reconstruct current or historical session tokens.\nThis flaw facilitates a bypass of authentication mechanisms, enabling unauthorized actors to gain administrative or operational control over the device without valid credentials. Given that Reyrolle 7SR5 devices are typically utilized in critical infrastructure protection, the potential for unauthorized manipulation of power system parameters represents a severe security risk.\nExploitation requires network access to the device's web interface. Successful attackers can masquerade as legitimate users, effectively circumventing session-based access controls. There is no requirement for prior authentication, as the attack leverages the session generation mechanism itself. The vulnerability poses a significant risk to the integrity and availability of the affected relay systems.",
  "technicalDetails": "The vulnerability resides within the session handling logic of the Reyrolle 7SR5 embedded web server. The root cause is the implementation of a cryptographically weak algorithm or an insufficient seed mechanism for the generation of session IDs. Instead of utilizing high-entropy, cryptographically secure pseudo-random number generators (CSPRNG), the application generates identifiers that exhibit predictable sequences or linear patterns.\nThe attack flow proceeds as follows: First, the attacker observes the web interface and records multiple session tokens issued during legitimate user interactions or via automated requests to the login portal. By performing cryptanalysis on these sampled session identifiers, the attacker can derive the underlying generation algorithm or identify the state progression of the PRNG. Once the generation logic is determined, the attacker can calculate subsequent session IDs or reconstruct historical ones.\nWith a predicted session ID, the attacker performs a session hijacking attack by injecting the forged identifier into the HTTP 'Cookie' header or other session-tracking parameters used by the device. Since the server validates the incoming request based on the predicted token, it grants the attacker an authenticated session context equivalent to that of a legitimate user. The vulnerable component is the session management module within the device's firmware web-server interface.\nThe exploitation does not require administrative privileges or valid credentials, as the weakness is inherent in the session creation phase, prior to authentication enforcement. The attack surface is limited to the network segment accessible to the device's web management interface. Once a session is successfully hijacked, the attacker gains the same level of access as the compromised user account. Depending on the session's privilege level, this may include the ability to alter relay settings, disable protection functions, extract configuration data, or perform firmware-level modifications. The risk remains persistent across all versions of the product below V2.70, necessitating a firmware update to implement secure, randomized session identifier generation and secure session lifecycle management practices."
}