Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-08T09:18:16.710Z",
  "pubdate": "2026-09-08T09:18:16.710Z",
  "executiveSummary": "A critical vulnerability exists in Reyrolle 7SR5, where the session management mechanism fails to implement sufficient entropy during identifier generation. This weakness affects all firmware versions prior to V2.70.\nThe vulnerability is classified as an insufficient randomness issue in cryptographic session management. It enables an unauthenticated remote attacker to predict or brute-force valid session identifiers.\nSuccessful exploitation allows an attacker to bypass authentication controls, potentially gaining unauthorized administrative or operational access to the device.\nGiven that these devices are typically deployed within critical infrastructure or industrial environments, the ability to hijack legitimate sessions poses a significant risk to operational integrity and security.\nExploitation does not require prior authentication, making the attack surface external and highly accessible if the device is reachable over a network.\nRemediation requires upgrading the device firmware to V2.70 or higher, which addresses the underlying PRNG (Pseudo-Random Number Generator) weaknesses identified in the session token creation process.",
  "technicalDetails": "The vulnerability resides within the session handling module of the Reyrolle 7SR5 firmware versions earlier than V2.70. The root cause is the implementation of a cryptographically weak algorithm for the generation of session tokens. Instead of utilizing a cryptographically secure pseudo-random number generator (CSPRNG) with sufficient seed entropy, the session manager employs a predictable or low-entropy generation process.\nIn a standard implementation, session identifiers must be generated in a manner that makes them statistically unpredictable and resistant to guessing. In the affected Reyrolle 7SR5 firmware, the token space is sufficiently constrained, or the internal state of the generator can be reconstructed by observing a series of generated tokens. This lack of entropy permits an attacker to perform successful predictive analysis.\nThe attack flow proceeds as follows: First, the attacker initiates multiple requests to the device's web or management interface to capture a sequence of valid session identifiers issued to the system. Second, the attacker analyzes these tokens to identify patterns or the state transition logic of the underlying generation algorithm. Due to the insufficient randomness, the attacker can then predict the next sequence of identifiers or conduct a targeted brute-force attack on the identifier space, which is feasible due to its low entropy.\nUpon successfully predicting a valid identifier, the attacker can forge a session cookie or token. By injecting this predicted identifier into their own HTTP requests, the attacker effectively impersonates an authorized user or administrator. This bypasses the standard authentication verification process entirely, as the server recognizes the attacker's session token as a valid, ongoing session.\nThis vulnerability is classified as a remote, unauthenticated access vector. No specific privileges are required to initiate the attempt, and the attack can be performed over any network protocol that relies on the flawed session management service. Once the attacker successfully hijacks the session, they can perform any actions permitted by the hijacked session's role. This often includes configuration changes, retrieval of sensitive device data, or modification of relay protection settings, leading to potentially severe impacts on the operational state of the protected electrical assets."
}