Reyrolle 7SR5 vulnerabilities

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities.

Reyrolle 7SR5 devices do not properly enforce server-side authorization checks in the web-based management interface. Manipulation of request data can bypass RBAC restrictions, allowing an authenticated low-privileged attacker to escalate to administrative level.

The web server in Reyrolle 7SR5 devices does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. An unauthenticated remote attacker can cause the device to crash and reboot, resulting in denial of service.

In Reyrolle 7SR5 devices, the length of the URL component in pre-authenticated HTTP messages is not properly validated before appending additional data, resulting in an out-of-bounds write. An unauthenticated remote attacker can crash the device, causing a reboot and denial of service.

In Reyrolle 7SR5 devices, a random number generator used for security-relevant values (such as session identifiers) is not initialized with a True Random Number Generator (TRNG), resulting in predictable sequences. An unauthenticated remote attacker can more easily predict values and impersonate a legitimate user.

In Reyrolle 7SR5 devices, session identifiers are generated using an algorithm with insufficient randomness, resulting in low-entropy tokens that can be predicted or brute-forced. An unauthenticated remote attacker can derive valid session identifiers and bypass authentication.

Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.