CVE-2026-62645: Reyrolle 7SR5 Auth Bypass Vulnerability

CVE-2026-62645 Overview

CVE-2026-62645 is an authentication bypass vulnerability affecting Siemens Reyrolle 7SR5 protection relays running firmware versions prior to V2.70. The web interface exposes information that attackers can use to calculate current and past session ID numbers. An unauthenticated remote attacker can leverage this predictable session identifier weakness to bypass authentication and gain unauthorized access to the device. The flaw is tracked under CWE-306: Missing Authentication for Critical Function and impacts substation protection equipment used in electrical grid environments.

Critical Impact
Remote unauthenticated attackers can bypass authentication on Reyrolle 7SR5 protection relays, gaining full access to a device that controls electrical substation protection functions.

Affected Products

Siemens Reyrolle 7SR5 (all versions before V2.70)
Substation protection relay firmware exposing the vulnerable web interface
Deployments in electrical grid and industrial control environments

Discovery Timeline

2026-09-08 - CVE-2026-62645 published to the National Vulnerability Database
2026-09-08 - Siemens published Security Advisory SSA-142885
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-62645

Vulnerability Analysis

The Reyrolle 7SR5 web interface leaks data that allows attackers to derive session identifiers used by authenticated users. Because session IDs are predictable rather than cryptographically random, an attacker can compute valid identifiers for current or prior sessions. Presenting a computed session ID to the device bypasses the authentication layer entirely.

This class of weakness maps to CWE-306: Missing Authentication for Critical Function. The web interface acts as the management surface for a protection relay, so bypassing authentication grants access to configuration and operational functions of a device deployed in electrical substations.

Exploitation requires only network reachability to the web interface. No user interaction, credentials, or privileges are needed. Successful exploitation grants control over device configuration, which in industrial environments may affect protection settings responsible for isolating faults on power feeders.

Root Cause

The root cause is insufficient entropy and information exposure in session identifier generation. The web interface reveals values that can be used to reconstruct session IDs, defeating the assumption that session tokens are unguessable. Session identifiers should be generated from a cryptographically secure random source and must not be derivable from data returned by the interface.

Attack Vector

An attacker with network access to the management interface queries the web application to obtain the leaked information. The attacker then calculates a valid session ID and submits requests using that identifier. The device treats the request as originating from an authenticated user and honors the associated privileges. No credentials, prior access, or user interaction is required.

No public proof-of-concept exploit code is available in the referenced sources. Technical specifics of the leaked values and calculation method are described in the Siemens Security Advisory SSA-142885.

Detection Methods for CVE-2026-62645

Indicators of Compromise

Unexpected authenticated sessions on Reyrolle 7SR5 web interfaces originating from unfamiliar source IPs
HTTP request patterns showing session ID enumeration or reuse from non-authenticated flows
Configuration changes on protection relays without corresponding operator login records
Web interface access from network segments that should not reach substation management planes

Detection Strategies

Inspect Reyrolle 7SR5 audit logs for session activity that lacks a preceding successful authentication event
Deploy network intrusion detection signatures for HTTP traffic to / endpoints on Reyrolle 7SR5 web interfaces that request session-related resources without login
Correlate operational technology (OT) firewall logs with device audit trails to identify unauthorized access attempts

Monitoring Recommendations

Forward Reyrolle 7SR5 syslog and audit data to a centralized SIEM for continuous review
Monitor for changes to protection settings, relay configuration files, or firmware outside authorized maintenance windows
Alert on any external or non-management-VLAN traffic targeting the 7SR5 web interface

How to Mitigate CVE-2026-62645

Immediate Actions Required

Upgrade Reyrolle 7SR5 firmware to V2.70 or later as directed by Siemens Security Advisory SSA-142885
Restrict network access to the 7SR5 web interface to trusted engineering workstations only
Audit existing sessions and configuration state for signs of unauthorized modification
Rotate any shared credentials used for device administration after patching

Patch Information

Siemens has released firmware version V2.70 for the Reyrolle 7SR5, which remediates the session identifier exposure. Operators should follow Siemens' documented firmware upgrade procedure and verify device integrity after the update. Refer to Siemens Security Advisory SSA-142885 for full patch details and version guidance.

Workarounds

Segment protection relays onto isolated OT management networks that block inbound access from corporate or external networks
Place the device behind a firewall that permits web interface access only from named engineering hosts
Disable the web interface where operationally feasible until the firmware upgrade is applied
Enforce VPN or jump-host access for any remote engineering session to the relay

bash

# Example firewall rule restricting Reyrolle 7SR5 web access to a single engineering workstation
# Replace RELAY_IP and ENG_WORKSTATION_IP with site-specific values
iptables -A FORWARD -p tcp -s ENG_WORKSTATION_IP -d RELAY_IP --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d RELAY_IP --dport 443 -j DROP
iptables -A FORWARD -p tcp -d RELAY_IP --dport 80  -j DROP