CVE-2026-62653 Overview
CVE-2026-62653 affects Siemens Reyrolle 7SR5 protection relays running firmware versions earlier than V2.70. The device exposes a proprietary communication protocol when placed into a special firmware-update mode. This protocol fails to properly validate received input, resulting in a memory corruption condition classified as an out-of-bounds write [CWE-787]. An attacker with physical access to the device can crash the relay and potentially execute arbitrary code on it. Reyrolle 7SR5 relays are deployed in electrical substation protection and control environments, where unexpected behavior can disrupt grid protection functions.
Critical Impact
Physical-access attackers can corrupt memory on Reyrolle 7SR5 relays running firmware below V2.70, causing device crashes and possible arbitrary code execution on protection equipment used in electrical substations.
Affected Products
- Siemens Reyrolle 7SR5 — all firmware versions prior to V2.70
- Devices operating in the proprietary firmware-update mode
- Substation protection deployments using vulnerable Reyrolle 7SR5 relays
Discovery Timeline
- 2026-09-08 - CVE-2026-62653 published to NVD
- 2026-09-08 - Last updated in NVD database
- Vendor reference - Siemens Security Advisory SSA-142885
Technical Details for CVE-2026-62653
Vulnerability Analysis
The vulnerability resides in the handling of messages received over a proprietary communication protocol exposed only when the Reyrolle 7SR5 is placed into firmware-update mode. Input validation on this protocol is insufficient, allowing crafted messages to trigger an out-of-bounds write. The condition maps to [CWE-787], a common source of memory corruption bugs in embedded firmware. The immediate observable effect is a crash of the device firmware, which halts protection functions. Depending on memory layout and the writable region reached by the corruption, an attacker may achieve arbitrary code execution on the relay. Because the affected surface is a firmware-update protocol, the code path frequently runs with elevated privileges on the embedded operating system.
Root Cause
The root cause is missing or inadequate bounds checking on data parsed from the proprietary update protocol. Length or offset fields supplied by the attacker are trusted without validation, allowing writes past the end of an intended buffer. Vendor remediation ships in firmware V2.70 and later.
Attack Vector
Exploitation requires physical access to the relay and the ability to place it into firmware-update mode. No authentication or user interaction is required once the device is in that mode. The attacker connects to the update interface and sends a malformed protocol message crafted to trigger the out-of-bounds write. Successful exploitation causes a denial-of-service crash and, in the worst case, arbitrary code execution on the device.
No public proof-of-concept code is available. For technical specifics, refer to the Siemens Security Advisory SSA-142885.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-62653
Indicators of Compromise
- Unexpected reboots, watchdog resets, or protection-function faults on Reyrolle 7SR5 relays
- Devices found in firmware-update mode outside of scheduled maintenance windows
- Physical connections to relay maintenance ports that do not correspond to authorized change tickets
- Firmware version reporting below V2.70 after a maintenance event that should have upgraded the device
Detection Strategies
- Audit substation access logs and physical intrusion detection systems for unauthorized access to relay cabinets
- Compare current firmware versions across the Reyrolle 7SR5 fleet against the approved baseline of V2.70 or later
- Monitor engineering workstations that interact with relays for unexpected use of firmware-update tooling
- Correlate relay crash events and protection alarms with physical access records
Monitoring Recommendations
- Enable syslog or SNMP forwarding from relays and substation gateways to a centralized log platform
- Alert on any transition of a Reyrolle 7SR5 into firmware-update mode
- Track badge access, door contacts, and CCTV events for substation and relay panel entries
- Review vendor advisories from Siemens ProductCERT on a recurring cadence and map findings to affected asset inventories
How to Mitigate CVE-2026-62653
Immediate Actions Required
- Update all Reyrolle 7SR5 devices to firmware V2.70 or later following Siemens' documented upgrade procedure
- Restrict physical access to substations, relay panels, and maintenance ports to authorized personnel only
- Ensure devices are placed into firmware-update mode only during authorized, ticketed maintenance windows
- Inventory all Reyrolle 7SR5 assets and record firmware versions to confirm remediation coverage
Patch Information
Siemens has addressed the vulnerability in Reyrolle 7SR5 firmware V2.70. Upgrade instructions and full advisory details are available in Siemens Security Advisory SSA-142885.
Workarounds
- Enforce strict physical security controls around substation equipment, including locked cabinets and monitored access
- Limit and log all use of the firmware-update mode through change-management processes
- Segment engineering and maintenance networks from operational networks to reduce lateral movement risk if a relay is compromised
- Follow Siemens' general operational security guidelines for industrial control system deployments
# Configuration example
# Verify Reyrolle 7SR5 firmware version reaches the fixed release
# Confirm reported version is V2.70 or later before returning the device to service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
