Quick answers
- Is CVE-2026-62653 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62653 being exploited in the wild.
- How severe is CVE-2026-62653?
- Medium severity, with a CVSS score of 6.8, published 8 September 2026.
- Which products and versions are affected?
- Siemens Reyrolle 7SR5 All versions < V2.70.
- Is there a fix for CVE-2026-62653?
- A patch was published on 2026-09-08: Update to V2.70 or later available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62653 attacked?
- It is attacked with physical access, in a network appliance.
- Am I affected by CVE-2026-62653?
- Check whether you run Siemens Reyrolle 7SR5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-62653 is a memory corruption vulnerability (CWE-120) in the input validation of Siemens Reyrolle 7SR5 versions before V2.70. The vulnerability exists in the proprietary communication protocol that is exposed when the device enters firmware-update mode. An unauthenticated attacker with physical access to the device can send improperly validated input that triggers memory corruption, resulting in a denial of service (crash) or potentially arbitrary code execution. The attack requires physical access and activation of the special firmware-update mode, but no authentication is required once that mode is entered. A patch is available in version 2.70 and later.
Affected products
- Siemens Reyrolle 7SR5 All versions < V2.70
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Update to V2.70 or later available