CVE-2026-62650 Overview
CVE-2026-62650 is an authorization bypass vulnerability affecting Siemens Reyrolle 7SR5 protection relays running firmware versions prior to V2.70. The web-based management interface fails to enforce server-side authorization checks, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. An authenticated, low-privileged remote attacker can escalate privileges to administrative level on the device.
Critical Impact
A low-privileged authenticated user can gain full administrative control of Reyrolle 7SR5 protection relays, compromising the confidentiality, integrity, and availability of substation protection functions.
Affected Products
- Siemens Reyrolle 7SR5 (all versions prior to V2.70)
- Web-based management interface component
- Protection relay firmware exposing RBAC-controlled endpoints
Discovery Timeline
- 2026-09-08 - CVE-2026-62650 published to NVD
- 2026-09-08 - Last updated in NVD database
- 2026-09-08 - Siemens publishes Security Advisory SSA-142885
Technical Details for CVE-2026-62650
Vulnerability Analysis
The Reyrolle 7SR5 web-based management interface implements role-based access control to separate administrative functions from lower-privileged user roles. The server relies on client-supplied context to determine whether a requested action is permitted. Because authorization is not consistently enforced on the server side, an attacker with valid low-privileged credentials can modify request parameters to invoke administrator-only functionality. This class of flaw is tracked under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].
Successful exploitation results in vertical privilege escalation. An attacker gains the ability to modify device configuration, manage user accounts, and alter protection relay settings that govern electrical substation operations. Because Reyrolle devices are deployed in operational technology environments, unauthorized administrative access can affect grid stability and safety functions.
Root Cause
The underlying defect is missing or incomplete server-side enforcement of RBAC decisions in the web management interface. The application appears to trust request data that should have been validated against the authenticated session's actual role. Any authorization performed only on the client, or checks that consult attacker-controllable request fields, can be bypassed by tampering with those fields.
Attack Vector
Exploitation requires network access to the web-based management interface and valid low-privileged credentials. The attacker sends crafted HTTP requests that reference privileged operations while manipulating role or identity indicators in the request. The server processes the request without re-validating authorization against the session context, granting administrative outcomes to the unprivileged caller.
No public proof-of-concept code has been published for CVE-2026-62650. Refer to the Siemens Security Advisory SSA-142885 for vendor technical details.
Detection Methods for CVE-2026-62650
Indicators of Compromise
- Unexpected creation, modification, or role elevation of user accounts on Reyrolle 7SR5 devices
- HTTP requests from low-privileged sessions targeting administrative endpoints of the management interface
- Configuration or firmware changes on protection relays outside of scheduled maintenance windows
- Audit log entries showing privileged actions performed by accounts that lack administrative role assignment
Detection Strategies
- Compare authenticated session role against the privilege level required by the invoked endpoint at the network or proxy layer
- Alert on request bodies or headers that include role, user, or permission fields sent from client-side callers
- Baseline normal administrative activity on the 7SR5 management interface and flag deviations by source IP and account
Monitoring Recommendations
- Forward Reyrolle 7SR5 audit logs and web interface access logs to a centralized SIEM for correlation
- Monitor OT network segments for anomalous HTTP traffic directed at protection relay management interfaces
- Track configuration change events on protection relays and reconcile them against approved change tickets
How to Mitigate CVE-2026-62650
Immediate Actions Required
- Inventory all Reyrolle 7SR5 devices and identify firmware versions below V2.70
- Restrict network access to the web-based management interface to trusted engineering workstations only
- Rotate credentials for all accounts on affected devices, prioritizing accounts with any level of interface access
- Review audit logs for privileged actions performed since the interface was exposed
Patch Information
Siemens has addressed CVE-2026-62650 in Reyrolle 7SR5 firmware V2.70 and later. Operators should schedule firmware upgrades in accordance with substation maintenance procedures. Full remediation guidance is available in the Siemens Security Advisory SSA-142885.
Workarounds
- Place Reyrolle 7SR5 devices behind a segmented OT network protected by a firewall that limits management interface access to authorized hosts
- Disable or minimize the number of low-privileged accounts on the device until patching is complete
- Enforce multi-factor authentication and jump-host access controls for any operator connecting to the management interface
- Continuously review protection relay configuration baselines to detect unauthorized changes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
