Siemens Reyrolle 7SR5 Hit With 14 CVEs, Patch to V2.70
The worst of them, CVE-2026-62645 at CVSS 9.8, is an authentication bypass that doesn't need credentials or user interaction.
TL;DR
Siemens has disclosed 14 vulnerabilities in its Reyrolle 7SR5 electrical protection relay, all fixed in firmware version V2.70. The most severe, CVE-2026-62645 (CVSS 9.8), lets an unauthenticated remote attacker bypass authentication entirely via session-ID material exposed through the web interface. The CVE set spans Mongoose Web Server flaws (integer overflows, out-of-bounds pointer offsets, delimiter handling bugs) and Siemens-specific weaknesses including insufficient session entropy and resource exhaustion that can crash and reboot the device. Operators running Reyrolle 7SR5 below V2.70 in energy-sector environments should apply the update; no compensating controls are listed.
The 14-CVE advisory covers two families of bugs: five in Cesanta Mongoose Web Server v7.14 and nine in Siemens's own implementation. The Mongoose flaws range from CVSS 4.0 (infinite-loop denial-of-service via malformed input) to CVSS 8.2 (out-of-range pointer offset producing segmentation faults on unexpected TLS packets). None of them require authentication. CVEs 2024-42384, 2024-42385, 2024-42386, 2024-42391, and 2024-42392 all trace to the same embedded webserver library.
But the attention belongs on the Siemens-specific CVEs.
CVE-2026-62645 (CVSS 9.8) is a missing-authentication-for-critical-function gap: the web interface exposes information sufficient to calculate both current and past session identifiers, making authentication bypass straightforward for an unauthenticated remote attacker. Two companion vulnerabilities (CVE-2026-62646 (insufficient entropy in session-ID generation) and CVE-2026-62647 (predictable random-number seeding without a true hardware RNG)) stack on top of it, turning what might have been a single bypass into a multi-vector authentication failure.
CVE-2026-62648 is an out-of-bounds write triggered by unvalidated URL-component length in pre-authentication HTTP messages; CVE-2026-62649 is an unthrottled resource-consumption path that crashes and reboots the device under concurrent request load. Both are denial-of-service vectors accessible without credentials.
The advisory provides no workarounds. The sole remediation is the V2.70 firmware update, available through Siemens's support portal. For 7SR5 devices deployed in substations where firmware updates queue behind maintenance windows measured in months, that's the operational problem. The relay is an electrical protection device; its availability is safety-critical. A crash-and-reboot cycle triggered by CVE-2026-62649 isn't just an outage, it's a protection gap on whatever feeder or transformer the relay is guarding.
CISA's advisory republishes Siemens's disclosure with the standard ICS-CERT defensive recommendations: minimize network exposure, isolate control-system networks behind firewalls, use VPNs when remote access is required. Those are boilerplate. The device either runs V2.70 or it doesn't.
Published ·Deep Fathom