Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Quick answers
What is CVE-2024-42391?
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
How severe is CVE-2024-42391?
critical, CVSS 9.8
Is CVE-2024-42391 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2024-42391 be mitigated?
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
CVSS
9.8
Vendor
Siemens
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
Siemens Reyrolle 7SR5
Mitigation
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Siemens Reyrolle 7SR5 devices running versions prior to V2.70 are affected by thirteen identified vulnerabilities in the embedded Cesanta Mongoose Web Server. The flaws span integer overflows, improper delimiter neutralization, out-of-range pointer offsets, insufficient entropy, and authentication bypass issues. Siemens has released version V2.70 as a remediation and urges affected users to update immediately. The vulnerabilities impact global Energy sector critical infrastructure.