CVE-2026-62646 Overview
CVE-2026-62646 is an authentication bypass vulnerability affecting Siemens Reyrolle 7SR5 protection relays in all firmware versions prior to V2.70. The device generates session identifiers using an algorithm with insufficient randomness [CWE-331]. The resulting tokens have low entropy and can be predicted or brute-forced within a feasible number of attempts. An unauthenticated remote attacker on the network can derive valid session identifiers and impersonate authenticated users. Because Reyrolle 7SR5 devices provide protection functions in electrical substations, unauthorized access can expose sensitive configuration and control interfaces.
Critical Impact
Unauthenticated remote attackers can predict session tokens and gain access to Reyrolle 7SR5 protection relays, compromising confidentiality and integrity of substation protection configurations.
Affected Products
- Siemens Reyrolle 7SR5 (all firmware versions before V2.70)
- Reyrolle 7SR5 protection relay management interfaces
- Deployments where the relay is reachable over the operational network
Discovery Timeline
- 2026-09-08 - CVE-2026-62646 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-62646
Vulnerability Analysis
The Reyrolle 7SR5 firmware generates session identifiers using a pseudo-random algorithm that does not provide sufficient entropy. Session identifiers are supposed to be unguessable values that bind an authenticated user to subsequent requests. When the underlying generator uses predictable inputs, small key space, or a weak algorithm, the resulting tokens fall within a range an attacker can enumerate.
An attacker who can reach the device's management service can iterate through candidate session identifiers or predict the next value based on observed tokens. Successful prediction produces a valid authenticated session without knowledge of credentials, defeating the login control entirely. Compromise of a substation protection relay can allow reading of protection settings, event logs, and modification of device state within the limits of the authenticated role.
Root Cause
The root cause is classified as CWE-331: Insufficient Entropy. The session identifier generation routine relies on a source of randomness that does not produce enough unique bits, or uses a deterministic algorithm whose state can be recovered from observed outputs. Either condition reduces the effective search space for valid tokens.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the Reyrolle 7SR5 management interface establishes an unauthenticated connection, then submits candidate session identifiers until one is accepted by the server. Once a valid session identifier is found, the attacker inherits the privileges of the associated session and can interact with the relay as that user.
No verified public proof-of-concept code is available. See the Siemens Security Advisory SSA-142885 for vendor-provided technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-62646
Indicators of Compromise
- Unusually high volumes of session-establishment or session-validation requests to a Reyrolle 7SR5 relay from a single source.
- Authenticated sessions on the relay that do not correlate to any preceding successful login event in audit logs.
- Configuration changes, event log downloads, or setting reads originating from source addresses not associated with engineering workstations.
Detection Strategies
- Baseline normal management traffic to each 7SR5 relay and alert on deviations in request rate, source address, or session duration.
- Correlate device audit logs with network flow data to identify sessions that lack a matching authentication event.
- Deploy passive network monitoring on substation LANs to identify enumeration patterns against relay management ports.
Monitoring Recommendations
- Forward Reyrolle 7SR5 syslog and audit events to a centralized SIEM for correlation with network telemetry.
- Monitor for repeated failed session validations, which can indicate token brute-force activity.
- Track firmware versions across the relay fleet and alert on any device still running a version below V2.70.
How to Mitigate CVE-2026-62646
Immediate Actions Required
- Upgrade all Reyrolle 7SR5 devices to firmware V2.70 or later, as directed by Siemens Security Advisory SSA-142885.
- Restrict network reachability of the relay management interface to a small, defined set of engineering workstations.
- Audit existing sessions and recent configuration changes on affected relays to identify potential unauthorized access.
Patch Information
Siemens has released firmware V2.70 for Reyrolle 7SR5, which addresses the insufficient entropy in session identifier generation. Refer to the Siemens Security Advisory SSA-142885 for download instructions and firmware verification details.
Workarounds
- Place Reyrolle 7SR5 devices behind a firewall that permits management traffic only from authorized engineering hosts.
- Segment the substation automation network from corporate and remote-access networks using strict access control lists.
- Require operators to access relays through a hardened jump host with session logging and multi-factor authentication.
- Disable or block unused management protocols and services on the relay where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
