Siemens Reyrolle 7SR5

Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.

Siemens' Reyrolle 7SR5 protection relay exposes, through its web interface, information that lets an attacker calculate the device's current and past session ID numbers (classified as CWE-306, missing authentication for a critical function). An attacker with network reachability to the web interface needs no privileges or user interaction (AV:N/PR:N/UI:N) and can use the calculated session IDs to bypass authentication and gain unauthorized access to the device. Successful exploitation carries high impact on the confidentiality, integrity, and availability of the affected relay itself (CVSS 4.0 9.3, critical), though the advisory does not describe broader grid impact. All Reyrolle 7SR5 versions below V2.70 are affected, per the Siemens product certification advisory (CNA). No public proof-of-concept, no CISA KEV listing, and a low EPSS (0.3%, 28th percentile) indicate that exploitation has not yet been reported.

Do: Upgrade Reyrolle 7SR5 devices to firmware V2.70 or later per Siemens' product security notification. Until patched, restrict access to the relay's web interface to trusted engineering/management networks, avoid internet exposure, and monitor for unauthenticated or anomalous sessions. No public PoC or in-the-wild exploitation is known (EPSS 0.3%), but the unauthenticated, network-reachable nature of the flaw justifies prompt patching wherever the web interface is reachable beyond tightly controlled OT segments.

CVE-2026-62646 is a weak session-identifier generation flaw (CWE-331) in the web interface of Siemens Reyrolle 7SR5 protection relays, where session tokens are generated with insufficient randomness and therefore carry low entropy. Because the tokens can be predicted or brute-forced within a feasible number of attempts, an unauthenticated remote attacker who can reach the device's web server can derive valid session identifiers without knowing any credentials. Successful exploitation bypasses authentication and gives the attacker access to the relay's management interface, with high confidentiality and high integrity impact reflected in the 9.1 CVSS 4.0 score (note the high attack complexity, since success depends on feasibly guessing usable tokens). Operators of Reyrolle 7SR5 relays running any firmware below V2.70 are affected, primarily utilities and industrial sites whose relays expose a web management interface reachable beyond the local substation network. Exploitation has not been observed: no public proof-of-concept exists, the issue is not in CISA's KEV catalog, and EPSS is 0.3%.

Do: Upgrade affected Reyrolle 7SR5 relays to firmware V2.70 or later. Until upgraded, restrict the relay's web interface to trusted management networks (ACLs, VPN, or OT/IT segmentation) or disable remote web access, since exploitation requires network reachability and feasible token guessing. Inventory which 7SR5 relays have the web server enabled and exposed, and monitor for unexpected authenticated sessions.

Siemens Reyrolle 7SR5 protection relays running all versions prior to V2.70 generate security-relevant values, including authentication session identifiers, using a random number generator that is not seeded by a True Random Number Generator, so the generated sequence is predictable. An unauthenticated remote attacker with network reachability to the device can predict these values and impersonate a legitimately authenticated user, gaining unauthorized access to the relay with high impact on confidentiality and integrity (CVSS 4.0: 9.3, critical). The attack requires no privileges or user interaction and is rated low attack complexity over the network. Affected users are operators of Reyrolle 7SR5 relays, which are typically deployed for feeder protection in utility and industrial substation environments. Exploitation status: no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days, so no in-the-wild exploitation is currently known.

Do: Upgrade affected Reyrolle 7SR5 relays to firmware V2.70 or later, which seeds security-relevant values from a TRNG. Until patched, restrict network access to the relay's management interface via firewalling or OT network segmentation, since exploitation requires remote reachability, and verify deployed firmware versions across your fleet. Monitor authentication logs for signs of session impersonation or anomalous authenticated sessions.

Siemens reports an out-of-bounds write (CWE-787) in the HTTP handling of the Reyrolle 7SR5 protection relay, where the length of the URL component in pre-authenticated HTTP messages is not validated before additional data is appended to it. A remote, unauthenticated attacker can trigger the flaw by sending crafted HTTP messages with an oversized URL directly to the device, corrupting memory and crashing it. The attacker gains a denial-of-service condition: the relay crashes and reboots, interrupting its operation, with no confidentiality or integrity impact per the CVSS 4.0 score (availability impact only). Any Reyrolle 7SR5 unit running a version prior to V2.70 with its HTTP/web interface enabled and reachable by an attacker is affected, though these relays typically sit on utility or industrial OT networks rather than the open internet. There is currently no known exploitation, no public proof-of-concept, and the flaw is not in CISA KEV, with a low EPSS probability (0.3%) of exploitation in the next 30 days.

Do: Upgrade affected Reyrolle 7SR5 devices to firmware V2.70 or later, per Siemens. Until patched, restrict network access to the relay's HTTP/web management interface so it is reachable only from trusted engineering or SCADA networks, and monitor for unexpected device reboots. Operators of substations or industrial sites using 7SR5 relays should inventory firmware versions and check Siemens' ProductCERT advisory for updates.

The embedded web server in Siemens Reyrolle 7SR5 protection relays (CWE-770) fails to properly limit or manage system resources when processing a high volume of concurrent HTTP requests. An unauthenticated remote attacker who can reach the relay's web interface can trigger resource exhaustion with a flood of concurrent requests, causing the entire device to crash and reboot. The attacker gains a denial-of-service condition, and because the 7SR5 is a substation protection relay, its protection function is unavailable while the device crashes and restarts. Any operator running Reyrolle 7SR5 firmware below V2.70 is affected, particularly where the relay's web server is reachable from routable or attacker-accessible networks. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

Do: Upgrade Reyrolle 7SR5 firmware to V2.70 or later, which resolves the issue; first inventory deployed relays and check their current firmware versions. Until patched, restrict access to the relay's web interface using firewalls/ACLs or a dedicated management network so only trusted hosts can send HTTP requests. Because the impact is loss of the relay's protection function, schedule upgrades within planned maintenance windows where a reboot matters.

Siemens Reyrolle 7SR5 protection relays running firmware before V2.70 fail to properly enforce server-side authorization checks in the web-based management interface (CWE-288). An authenticated, low-privileged remote attacker can bypass role-based access control by manipulating request data, because authorization decisions are not correctly validated on the server. Successful exploitation elevates the attacker from a low-privileged account to administrative level on the device, allowing full management and configuration actions; CVSS 4.0 rates the confidentiality, integrity and availability impact on the vulnerable system as high (8.7). Any Reyrolle 7SR5 unit with the web interface enabled and firmware below V2.70 is affected, typically in utility substation and industrial power deployments where the interface is reachable from an operational network. As of publication there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates a ~0.3% probability of exploitation within 30 days (25th percentile).

Do: Upgrade Reyrolle 7SR5 firmware to V2.70 or later per the Siemens ProductCert advisory. Until patched, restrict the relay's web management interface to trusted management networks, minimize or remove low-privileged web accounts, and check device configurations/logs for unexpected changes. Exploitation requires valid low-privileged credentials, so account hygiene and network segmentation are the key interim mitigations.

Siemens has reported that Reyrolle 7SR5 protection relay firmware versions prior to V2.70 ship with binaries from which debugging symbols were not stripped (CWE-215). An unauthenticated attacker does not need access to the device itself; the flaw is triggered by downloading the publicly available firmware update files and analyzing them offline. What the attacker gains is not direct control of the relay but a significantly easier reverse-engineering path, which lowers the effort required to find exploitable memory-corruption, authentication, or protocol weaknesses in the same firmware. Affected devices are Reyrolle 7SR5 numerical protection relays, typically deployed in medium-voltage distribution substations at utilities and industrial sites, running any version older than V2.70. There is no known public proof of concept, the CVE is not in the CISA KEV catalog, and EPSS estimates only about a 0.2% chance of exploitation in the next 30 days, consistent with an informational/hardening weakness rather than a directly weaponizable bug.

Do: Update Reyrolle 7SR5 relays to firmware V2.70 or later once a suitable maintenance window is available, since fixed builds strip the debugging symbols. In the interim, treat publicly hosted firmware images as sensitive: restrict where update files are stored and shared, and ensure relay engineering ports and firmware-update access are limited to segmented, authenticated OT networks rather than routable paths. Also verify that no analyst tooling or older firmware copies have been left on internet-accessible file shares, and monitor Siemens advisories for follow-on vulnerabilities that this easier reverse engineering could uncover.

Siemens Reyrolle 7SR5 protection relays running firmware older than V2.70 contain a memory-corruption flaw (CWE-787) in the input handling of a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode. An unauthenticated attacker with physical access can feed malformed protocol input during this mode, triggering the corruption, which crashes the device and could potentially allow arbitrary code execution on the relay. Because the attack vector is physical, the flaw cannot be triggered remotely or over the internet, and the relay's protective functions are not impacted beyond the device itself (no subsequent system impact in the CVSS score). All Reyrolle 7SR5 deployments on firmware below V2.70 are affected. There is currently no known public proof-of-concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns a 0.2% probability of exploitation within 30 days.

Do: Upgrade Reyrolle 7SR5 relays to firmware V2.70 or later, prioritizing units where untrusted personnel may have physical access. Until patched, restrict physical access to relays and avoid placing devices into the special firmware-update mode except during controlled maintenance. Check asset-management records or relay configuration files to inventory which 7SR5 units you operate and their firmware versions.

CVE-2026-62654 is a download-of-code-without-integrity-check flaw (CWE-494) in Siemens Reyrolle 7SR5 protection relays: when a special maintenance mode is active, the device downloads and executes program code from a network server without verifying its authenticity or integrity. Maintenance mode is activated with a physical key sequence during device boot, so exploiting the flaw requires an attacker to have physical access to the relay; no authentication or user interaction beyond that is required. An attacker who triggers this mode can upload and execute arbitrary, unsigned code on the device, with high confidentiality, integrity, and availability impact on the relay itself. All Reyrolle 7SR5 versions below V2.70 are affected; these relays are installed in utility and industrial substations and are generally not internet-exposed, limiting realistic attack paths to physically present personnel or intruders. There is currently no public proof-of-concept, no CISA KEV listing, and no known exploitation, with EPSS estimating only a 0.1% probability of exploitation within 30 days.

Do: Update affected Reyrolle 7SR5 relays to V2.70 or later per Siemens ProductCERT guidance. Until upgraded, restrict physical access to the relays (locked switchgear rooms and cabinets), treat the network server the device loads maintenance-mode code from as a trusted, controlled resource, and monitor/supervise any reboot or maintenance-mode activity on installed units.