Source: cisa.gov
Siemens Reyrolle 7SR5 protective relay devices running firmware versions prior to V2.70 are affected by 14 vulnerabilities spanning a wide range of weakness types. The highest severity vulnerability (CVE-2026-62645) carries a CVSS v3 score of 9.8 CRITICAL and allows unauthenticated remote attackers to bypass authentication by calculating session IDs exposed through the web interface. Additional critical issues include insufficient entropy in session ID generation, authentication bypass via alternate paths, out-of-bounds writes causing denial-of-service, and resource exhaustion from unthrottled HTTP requests. Physical access vulnerabilities allow arbitrary unsigned code execution via a maintenance boot mode and memory corruption during firmware update mode. The Cesanta Mongoose Web Server v7.14 component contributes several integer overflow, pointer offset, and delimiter neutralization flaws. The device is deployed worldwide in the Energy critical infrastructure sector. Siemens has released V2.70 to address all vulnerabilities and recommends immediate update. CISA republished this advisory from Siemens ProductCERT SSA-142885 on 2026-09-15.
