Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-08T09:18:16.840Z",
  "pubdate": "2026-09-08T09:18:16.840Z",
  "executiveSummary": "This vulnerability involves the use of an insufficiently random number generator for critical security functions within the Reyrolle 7SR5 product line. The core issue lies in the reliance on a non-cryptographically secure or uninitialized pseudo-random number generation process, rather than a True Random Number Generator (TRNG), to produce sensitive values such as session identifiers.\nThe primary impact is the potential for session hijacking and unauthorized authentication bypass. By analyzing the predictable sequence generated by the underlying software, an unauthenticated remote attacker can forecast future security tokens. This capability allows an attacker to impersonate legitimate authenticated users without possessing valid credentials. The vulnerability affects all versions of Reyrolle 7SR5 prior to V2.70 and carries significant risk, as it effectively nullifies the authentication mechanisms protecting the device. Successful exploitation does not require prior authentication or elevated privileges, significantly lowering the barrier for remote actors to gain administrative or operational control over the affected hardware.",
  "technicalDetails": "The vulnerability stems from the implementation of an insecure pseudo-random number generator (PRNG) for the purpose of creating security-critical artifacts. Specifically, the software fails to utilize a TRNG or a cryptographically secure pseudo-random number generator (CSPRNG) seeded with high-entropy environmental noise. In the context of Reyrolle 7SR5 (all versions < V2.70), the generation of session identifiers follows a deterministic algorithm where the output is directly dependent on a predictable internal state or a static seed.\nThe attack flow begins with the reconnaissance phase, where an attacker captures multiple valid session tokens assigned by the device during legitimate authentication requests. By analyzing the sequence of these captured identifiers, the attacker can derive the internal state of the PRNG or identify the underlying algorithm's progression pattern. Once the algorithm or state transition logic is successfully modeled, the attacker can calculate the subsequent values that the device will issue for new authentication sessions.\nExploitation occurs when an attacker computes a future valid session identifier and injects this token into an HTTP request or relevant communication protocol header. The device, relying on its insecure PRNG, validates the attacker-supplied identifier against its internal expectation of the next generated token. Because the attacker has correctly predicted the output, the device erroneously treats the session as legitimate and authorized. This bypasses the traditional authentication handshake entirely, granting the attacker the permissions associated with the hijacked session.\nThe exposure is network-wide, as the vulnerability resides in the core session management logic of the device's management interface. Because no authentication is required to initiate the observation of session token sequences, the device is susceptible to remote exploitation from any network segment capable of communicating with the device's management services. Post-exploitation, the attacker maintains unauthorized access, allowing for the execution of arbitrary management commands, configuration changes, or the retrieval of sensitive operational data. The reliance on predictable, low-entropy values for identity management represents a critical failure in the cryptographic implementation of the product's security architecture, necessitating an upgrade to version V2.70 or higher to transition to a more secure, entropy-sourced generation mechanism."
}