# CVE-2026-62648: Siemens Reyrolle 7SR5 out-of-bounds write in URL validation

Source: https://junglewise.ai/threats/cve-2026-62648-siemens-reyrolle-7sr5-out-of-bounds-write-in-url-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-62648 · Severity: high · CVSS 7.5 · Published 2026-09-08

Reyrolle 7SR5 is a protection and automation device used in electrical substations. An unauthenticated attacker can send a specially crafted HTTP request with an invalid URL length that causes an out-of-bounds memory write, crashing the device and denying legitimate access until it reboots.

Technologies: [Siemens Reyrolle 7SR5](https://junglewise.ai/threats/technologies/reyrolle-7sr5). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-62648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62648 being exploited in the wild.

**How severe is CVE-2026-62648?** High severity, with a CVSS score of 7.5, published 8 September 2026.

**Which products and versions are affected?** Siemens Reyrolle 7SR5 All versions before V2.70.

**Is there a fix for CVE-2026-62648?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62648 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-62648?** Check whether you run Siemens Reyrolle 7SR5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an out-of-bounds write vulnerability caused by improper validation of the URL component length in pre-authenticated HTTP messages. The vulnerable code does not check the URL length before appending additional data to it, resulting in a buffer overflow in memory. An unauthenticated remote attacker on the network can exploit this by sending a malformed HTTP request, triggering a crash and denial-of-service condition. A patch is available via update to version V2.70 or later.

## Affected products

- Siemens Reyrolle 7SR5 All versions before V2.70

## Timeline

- 2026-09-08: disclosed

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-142885.html](https://cert-portal.siemens.com/productcert/html/ssa-142885.html)

## Related threats

- [Siemens Reyrolle 7SR5 unsigned code execution in maintenance mode](https://junglewise.ai/threats/cve-2026-62654-siemens-reyrolle-7sr5-unsigned-code-execution-in-maintenance-mode)
- [Siemens Reyrolle 7SR5 memory corruption in firmware-update protocol](https://junglewise.ai/threats/cve-2026-62653-siemens-reyrolle-7sr5-memory-corruption-in-firmware-update)
- [Siemens Reyrolle 7SR5 unstripped debug symbols in firmware](https://junglewise.ai/threats/cve-2026-62652-siemens-reyrolle-7sr5-unstripped-debug-symbols-in-firmware)
- [Siemens Reyrolle 7SR5 privilege escalation via RBAC bypass](https://junglewise.ai/threats/cve-2026-62650-siemens-reyrolle-7sr5-privilege-escalation-via-rbac-bypass)
- [Siemens Reyrolle 7SR5 denial-of-service via resource exhaustion](https://junglewise.ai/threats/cve-2026-62649-siemens-reyrolle-7sr5-denial-of-service-via-resource-exhaustion)