Predictable Session Identifiers in Siemens Reyrolle 7SR5 Allow User Impersonation
AI analysis
Siemens Reyrolle 7SR5 protection relays running all versions prior to V2.70 generate security-relevant values, including authentication session identifiers, using a random number generator that is not seeded by a True Random Number Generator, so the generated sequence is predictable. An unauthenticated remote attacker with network reachability to the device can predict these values and impersonate a legitimately authenticated user, gaining unauthorized access to the relay with high impact on confidentiality and integrity (CVSS 4.0: 9.3, critical). The attack requires no privileges or user interaction and is rated low attack complexity over the network. Affected users are operators of Reyrolle 7SR5 relays, which are typically deployed for feeder protection in utility and industrial substation environments. Exploitation status: no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days, so no in-the-wild exploitation is currently known.
What to do: Upgrade affected Reyrolle 7SR5 relays to firmware V2.70 or later, which seeds security-relevant values from a TRNG. Until patched, restrict network access to the relay's management interface via firewalling or OT network segmentation, since exploitation requires remote reachability, and verify deployed firmware versions across your fleet. Monitor authentication logs for signs of session impersonation or anomalous authenticated sessions.
Affected
| Siemens Reyrolle 7SR5 | All versions < V2.70 |
Estimated exposure
unknown — likely on the order of thousands of deployed relays worldwide, with only a small subset remotely reachable (estimate) — No public install-base counts or internet-exposure scan data exist for this product; the estimate is based on the deployment pattern of substation protection relays, which usually sit on utility operational technology networks rather than…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.