AI analysis
Siemens Reyrolle 7SR5 protection relays running firmware older than V2.70 contain a memory-corruption flaw (CWE-787) in the input handling of a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode. An unauthenticated attacker with physical access can feed malformed protocol input during this mode, triggering the corruption, which crashes the device and could potentially allow arbitrary code execution on the relay. Because the attack vector is physical, the flaw cannot be triggered remotely or over the internet, and the relay's protective functions are not impacted beyond the device itself (no subsequent system impact in the CVSS score). All Reyrolle 7SR5 deployments on firmware below V2.70 are affected. There is currently no known public proof-of-concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns a 0.2% probability of exploitation within 30 days.
What to do: Upgrade Reyrolle 7SR5 relays to firmware V2.70 or later, prioritizing units where untrusted personnel may have physical access. Until patched, restrict physical access to relays and avoid placing devices into the special firmware-update mode except during controlled maintenance. Check asset-management records or relay configuration files to inventory which 7SR5 units you operate and their firmware versions.
Affected
| Siemens Reyrolle 7SR5 protection relay | All versions < V2.70 |
Estimated exposure
nichelikely on the order of tens of thousands of deployed relay units worldwide (estimate; no public install counts) — Reyrolle 7SR5 relays are specialized feeder-protection devices installed per-substation in utility and industrial power networks, are not typically internet-exposed, and the flaw additionally requires physical access during a special…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.