CVE-2026-62652

Siemens has reported that Reyrolle 7SR5 protection relay firmware versions prior to V2.70 ship with binaries from which debugging symbols were not stripped (CWE-215). An unauthenticated attacker does not need access to the device itself; the flaw is triggered by downloading the publicly available firmware update files and analyzing them offline. What the attacker gains is not direct control of the relay but a significantly easier reverse-engineering path, which lowers the effort required to find exploitable memory-corruption, authentication, or protocol weaknesses in the same firmware. Affected devices are Reyrolle 7SR5 numerical protection relays, typically deployed in medium-voltage distribution substations at utilities and industrial sites, running any version older than V2.70. There is no known public proof of concept, the CVE is not in the CISA KEV catalog, and EPSS estimates only about a 0.2% chance of exploitation in the next 30 days, consistent with an informational/hardening weakness rather than a directly weaponizable bug.

What to do: Update Reyrolle 7SR5 relays to firmware V2.70 or later once a suitable maintenance window is available, since fixed builds strip the debugging symbols. In the interim, treat publicly hosted firmware images as sensitive: restrict where update files are stored and shared, and ensure relay engineering ports and firmware-update access are limited to segmented, authenticated OT networks rather than routable paths. Also verify that no analyst tooling or older firmware copies have been left on internet-accessible file shares, and monitor Siemens advisories for follow-on vulnerabilities that this easier reverse engineering could uncover.