CVE-2026-62647: Reyrolle 7SR5 Auth Bypass Vulnerability

CVE-2026-62647 Overview

CVE-2026-62647 is an insecure random number generation vulnerability affecting Siemens Reyrolle 7SR5 protection relays running firmware versions prior to V2.70. The device generates security-relevant values, including session identifiers used for authentication, using a random number generator that is not seeded by a True Random Number Generator (TRNG). This produces a predictable sequence of values that an unauthenticated remote attacker can forecast. Successful prediction allows the attacker to impersonate an authenticated user and obtain unauthorized access to the device. The weakness is tracked under [CWE-20] (Improper Input Validation) in the National Vulnerability Database.

Critical Impact
An unauthenticated network attacker can predict session identifiers, impersonate legitimate users, and gain unauthorized access to a substation protection relay.

Affected Products

Siemens Reyrolle 7SR5 — all firmware versions prior to V2.70
Deployments using the affected relay for protection, control, and monitoring in electrical substations
Environments exposing the relay's management interface to reachable networks

Discovery Timeline

2026-09-08 - CVE-2026-62647 published to NVD
2026-09-08 - Last updated in NVD database
Vendor advisory - Siemens Security Advisory SSA-142885

Technical Details for CVE-2026-62647

Vulnerability Analysis

The Reyrolle 7SR5 relay uses a pseudo-random number generator (PRNG) to produce session identifiers and other security-relevant values. The PRNG is not initialized from a True Random Number Generator (TRNG) or another cryptographically strong entropy source. As a result, the output sequence is deterministic once an attacker recovers or infers the generator state. An unauthenticated remote attacker who can observe or enumerate generated identifiers can predict subsequent values. Predicted session identifiers can be replayed against the device to hijack an authenticated session without possessing valid credentials. The vulnerability is exploitable over the network with no user interaction, which is why it carries a high confidentiality and integrity impact.

Root Cause

The root cause is insecure random number generation in the authentication subsystem. Session identifiers derive from a PRNG that lacks TRNG seeding, so the entropy pool is insufficient to guarantee unpredictability. This condition is classified under [CWE-20] in the NVD entry but reflects a cryptographic weakness in entropy sourcing.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker on a network path to the relay's management interface collects a small number of session identifiers, models the PRNG output, and predicts a valid identifier for an active session. The attacker then submits the predicted identifier to the device and acts as the impersonated user. Refer to the Siemens Security Advisory SSA-142885 for vendor-supplied technical detail.

// No verified proof-of-concept code has been published for CVE-2026-62647.
// See the Siemens advisory for authoritative technical detail.

Detection Methods for CVE-2026-62647

Indicators of Compromise

Authenticated sessions on the relay originating from IP addresses that never completed a valid login exchange
Repeated short-lived connections to the relay's management interface consistent with identifier enumeration
Configuration changes, setting reads, or command executions attributed to a user account without a matching prior authentication event
Overlapping active sessions for the same operator account from distinct source addresses

Detection Strategies

Correlate authentication events with subsequent authorized actions and alert when authorized actions lack a preceding successful login
Baseline normal engineering-workstation source addresses and flag session activity from unexpected hosts
Monitor for rapid, sequential probes against the relay's HTTP or proprietary management ports that could indicate identifier harvesting

Monitoring Recommendations

Forward relay audit logs and network flows to a centralized analytics platform for cross-source correlation
Alert on any successful privileged action performed by an account that has not authenticated within the expected session window
Track firmware versions across the Reyrolle 7SR5 fleet and flag devices still running versions below V2.70

How to Mitigate CVE-2026-62647

Immediate Actions Required

Upgrade all Reyrolle 7SR5 devices to firmware V2.70 or later as specified in Siemens Security Advisory SSA-142885
Restrict network reachability of the relay's management interface to a dedicated operations VLAN and jump host
Rotate any credentials or session material used on affected devices after patching
Inventory all Reyrolle 7SR5 deployments and confirm firmware level as part of the change record

Patch Information

Siemens fixed the vulnerability in Reyrolle 7SR5 firmware V2.70. Operators should schedule maintenance windows aligned with substation change-control procedures and validate protection functionality after the upgrade. Consult Siemens Security Advisory SSA-142885 for the authoritative fix guidance.

Workarounds

Place the relay behind a firewall that only permits management traffic from approved engineering workstations
Terminate management access over a hardened VPN or bastion host with strong authentication and session logging
Disable unused network services on the relay to reduce exposure of session-bearing interfaces
Continuously monitor authentication and command activity on the device until the firmware upgrade is complete

bash

# Example: restrict access to the relay management interface at the perimeter
# Replace RELAY_IP and MGMT_HOST with values appropriate for your environment
iptables -A FORWARD -s MGMT_HOST -d RELAY_IP -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d RELAY_IP -p tcp --dport 443 -j DROP