CVE-2026-62649: Reyrolle 7SR5 Web Server DoS Vulnerability

CVE-2026-62649 Overview

CVE-2026-62649 affects the Siemens Reyrolle 7SR5 protection relay web server. The web server fails to properly limit or manage system resources when processing a high volume of concurrent HTTP requests. An unauthenticated remote attacker can exploit this condition to crash and reboot the device, producing a denial-of-service state. All firmware versions prior to V2.70 are affected. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling] and documented in Siemens Security Advisory SSA-142885.

Critical Impact
An unauthenticated network attacker can force a full device crash and reboot of Reyrolle 7SR5 protection relays, disrupting substation protection functions.

Affected Products

Siemens Reyrolle 7SR5 (all versions prior to V2.70)
Web server component exposed on the device management interface
Deployments in electrical substation protection and control environments

Discovery Timeline

2026-09-08 - CVE-2026-62649 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-62649

Vulnerability Analysis

The Reyrolle 7SR5 is a numerical protection relay used in medium and high-voltage substation automation. Its embedded web server accepts HTTP requests for management and configuration operations. When the server receives a large volume of concurrent requests, it does not throttle allocations or bound resource consumption. Available memory, sockets, or processing threads are consumed until the underlying process fails. The device then crashes and reboots, interrupting protective relaying and monitoring functions for the reboot duration. Because protection relays supervise breaker operations, sustained unavailability can compromise fault clearance timing in the substation. The flaw requires no authentication and no user interaction to trigger.

Root Cause

The root cause is [CWE-770: Allocation of Resources Without Limits or Throttling]. The web server does not enforce request rate limits, per-client connection caps, or memory allocation ceilings when handling parallel HTTP sessions. Sustained concurrent traffic exhausts finite embedded resources and destabilizes the firmware runtime.

Attack Vector

Exploitation occurs over the network. The attacker sends a high volume of concurrent HTTP requests to the web management interface of an exposed Reyrolle 7SR5 relay. No credentials, prior access, or user interaction are required. The impact is limited to availability; confidentiality and integrity are unaffected. Devices reachable from operational technology (OT) networks or, in misconfigured deployments, from corporate or internet-facing segments are at greatest risk.

No public proof-of-concept or exploit code has been published. See Siemens Security Advisory SSA-142885 for vendor technical details.

Detection Methods for CVE-2026-62649

Indicators of Compromise

Unexpected reboots or watchdog resets logged by Reyrolle 7SR5 devices during periods of external network activity.
Bursts of concurrent HTTP connections from a single source IP toward substation relay management interfaces.
Loss of SCADA polling responses coinciding with spikes in HTTP traffic to relay web servers.

Detection Strategies

Monitor OT network segments for HTTP connection floods targeting the management IP addresses of Reyrolle 7SR5 devices.
Correlate relay device restart events with network flow records to identify request-driven crashes.
Alert on any inbound HTTP traffic to protection relays from sources outside the authorized engineering workstation set.

Monitoring Recommendations

Enable syslog forwarding from relays and substation gateways into a centralized SIEM or data lake for reboot event correlation.
Deploy passive OT network monitoring to baseline HTTP volumes to Reyrolle 7SR5 endpoints and alert on deviations.
Track EPSS scoring updates for CVE-2026-62649 to detect changes in exploitation likelihood; current EPSS is 0.327%.

How to Mitigate CVE-2026-62649

Immediate Actions Required

Inventory all Reyrolle 7SR5 devices and identify firmware versions below V2.70.
Restrict network access to relay web interfaces so only authorized engineering workstations and jump hosts can reach TCP management ports.
Place relays behind an OT firewall or data diode and block HTTP traffic from untrusted VLANs and remote networks.
Schedule firmware upgrades to V2.70 or later through Siemens-approved change control procedures.

Patch Information

Siemens has released Reyrolle 7SR5 firmware V2.70, which addresses CVE-2026-62649. Refer to Siemens Security Advisory SSA-142885 for download instructions, upgrade prerequisites, and validation guidance for substation deployments.

Workarounds

Disable the web server on Reyrolle 7SR5 devices if it is not required for operations, using an authorized configuration tool.
Apply network-layer rate limiting on upstream OT firewalls to constrain concurrent HTTP sessions per source toward relay management interfaces.
Follow Siemens operational guidelines for industrial security to segment substation automation networks from corporate and remote-access networks.

bash

# Example firewall rule concept: restrict HTTP access to Reyrolle 7SR5 management
# Allow only the engineering workstation subnet; block all other sources
iptables -A FORWARD -p tcp -s 10.20.30.0/24 -d <relay_ip> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <relay_ip> --dport 80 -j DROP