Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-08T09:18:16.963Z",
  "pubdate": "2026-09-08T09:18:16.963Z",
  "executiveSummary": "A critical vulnerability exists in the Reyrolle 7SR5 series, specifically in versions prior to V2.70, stemming from improper input validation of HTTP URL components. This flaw permits an out-of-bounds write during memory operations, which can be triggered by an unauthenticated, remote attacker.\nThe vulnerability manifests when the system fails to verify the length of a URL parameter before appending subsequent data. By supplying a maliciously crafted HTTP request, an attacker can overwrite adjacent memory segments. The primary impact of successful exploitation is a service disruption, as the memory corruption forces the affected device to crash and subsequently reboot, leading to a denial-of-service (DoS) condition.\nAs this flaw is reachable via unauthenticated pre-authenticated HTTP messages, the attack surface is exposed to any network entity with access to the device's management interface. Given the nature of industrial control hardware, this vulnerability poses a significant risk to system availability and operational continuity. Remediation is required through firmware updates to ensure proper boundary checking on incoming network traffic.",
  "technicalDetails": "The root cause of this vulnerability lies in a lack of rigorous bounds checking within the HTTP processing logic of the Reyrolle 7SR5 firmware. Specifically, the component responsible for parsing URL components in pre-authenticated HTTP messages fails to validate the size of the input buffer before executing memory-append operations. Because the system does not enforce strict length constraints on these segments, an attacker can provide a URL component that exceeds the allocated destination buffer size.\nThe exploitation mechanism involves an out-of-bounds write (OOBW) vulnerability. When the system attempts to append additional data to a pre-authenticated HTTP URL component, it writes past the defined boundaries of the destination buffer. This memory corruption impacts the device's volatile memory, potentially overwriting critical process data, stack frames, or instruction pointers depending on the memory layout at the time of the request.\nThe attack flow proceeds as follows: An unauthenticated remote attacker sends a specifically crafted HTTP request to the device's web server. The request includes an oversized URL component designed to trigger the unsafe memory copy operation. The application logic, lacking necessary length checks, blindly appends secondary data to this oversized primary input, resulting in an out-of-bounds write that corrupts contiguous memory addresses. The memory corruption compromises the integrity of the device's operational state, triggering an exception or an kernel panic that leads to an immediate system crash and an automated reboot cycle. Consequently, the device is rendered unavailable to perform its intended functions, effectively achieving a Denial-of-Service condition.\nThis vulnerability is particularly concerning as it requires no prior authentication or administrative privileges, allowing exploitation via standard network protocols over the device's exposed interface. The scope of impact is limited to the system's runtime availability, as the device becomes unresponsive during the crash-and-reboot sequence. Successful exploitation relies on the predictability of the memory layout and the presence of the insecure processing function, which is present in all firmware iterations prior to V2.70. Defensive efforts must focus on ensuring that all input handling routines implement robust length verification and bounds-checking mechanisms to prevent the buffer from being overflown during concatenation tasks."
}