CVE-2026-62646

HighCVSS 7.4/10Last modified Sep 10, 2026

Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-626477.4A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant CVE-2026-626487.5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated CVE-2026-626497.5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resourc CVE-2026-62658.8Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been res CVE-2026-626508.8A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management in CVE-2026-626525.3A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symb CVE-2026-626536.8A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol th CVE-2026-626546.8A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key CVE-2026-626555.7A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or res CVE-2026-626565.4A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router a CVE-2026-626574.9A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk mode CVE-2026-626584.7A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to r