CVE-2026-62654 Overview
CVE-2026-62654 affects Siemens Reyrolle 7SR5 protection relays in all versions prior to V2.70. The device exposes a special maintenance mode that can be activated through a physical key sequence during boot. Once active, the device downloads and executes program code from a network server without verifying authenticity or integrity. An attacker with physical access can load and run arbitrary, unsigned code on the relay. The weakness is categorized as Download of Code Without Integrity Check [CWE-494].
Critical Impact
Physical access to a Reyrolle 7SR5 device allows attackers to execute unsigned firmware or program code, compromising the integrity of substation protection functions.
Affected Products
- Siemens Reyrolle 7SR5 — all versions prior to V2.70
Discovery Timeline
- 2026-09-08 - CVE-2026-62654 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-62654
Vulnerability Analysis
The Reyrolle 7SR5 is a digital protection relay used in electrical substations. A hidden maintenance mode activates when a specific physical key sequence is entered during device boot. In this state, the device fetches program code from a network server and executes it directly. The bootloader logic performs no signature verification and no integrity check on the retrieved payload. An operator or intruder with physical console access can therefore stage a rogue server on the maintenance network and deliver attacker-controlled binaries. Because the code executes on the relay itself, the attacker gains control over the trip logic that isolates faults in the power grid.
Root Cause
The root cause is a missing authenticity and integrity check on downloaded code, aligned with [CWE-494]. The maintenance workflow assumes the physical console and adjacent network are trustworthy. It omits code signing, hash validation, and transport-layer authentication before executing the retrieved image.
Attack Vector
Exploitation requires physical access to the device, per the CVSS 4.0 vector component AV:P. The attacker interrupts the boot sequence with the documented key combination, connects the relay to a controlled network segment hosting a malicious file server, and triggers the download. The relay accepts and runs whatever binary the server returns. No credentials or user interaction beyond physical presence are required.
No verified public exploit code is available. See the Siemens Security Advisory SSA-142885 for vendor-specific technical detail.
Detection Methods for CVE-2026-62654
Indicators of Compromise
- Unexpected reboots of Reyrolle 7SR5 devices, particularly outside of scheduled maintenance windows.
- Unauthorized network sessions originating from a 7SR5 relay to an unknown host during boot.
- Firmware or configuration versions on the relay that do not match the approved baseline recorded in asset inventory.
Detection Strategies
- Compare device firmware fingerprints and configuration checksums against a known-good baseline after every maintenance window.
- Enable and forward Reyrolle 7SR5 event and audit logs to a central log platform for correlation with physical access records.
- Monitor engineering and maintenance VLANs for unauthorized TFTP, FTP, or HTTP servers that could stage payloads to relays during boot.
Monitoring Recommendations
- Alert on any physical console cable connection or panel access to substation relays through door contacts and CCTV analytics.
- Baseline outbound network flows from protection relays and alert on any deviation, especially file-transfer protocols.
- Reconcile change tickets with observed device restarts to identify unauthorized maintenance activity.
How to Mitigate CVE-2026-62654
Immediate Actions Required
- Restrict physical access to substation cabinets housing Reyrolle 7SR5 devices using locks, tamper seals, and access logging.
- Segment the maintenance network so relays cannot reach untrusted hosts during boot.
- Inventory all 7SR5 devices and identify units running versions below V2.70 for prioritized patching.
Patch Information
Siemens addresses the issue in Reyrolle 7SR5 V2.70 and later. Refer to the Siemens Security Advisory SSA-142885 for the official fix and upgrade instructions.
Workarounds
- Disable or physically block access to the maintenance key sequence on deployed devices where operationally feasible.
- Enforce that maintenance activities occur only on an isolated, authenticated network with no path to untrusted systems.
- Require two-person integrity for any on-site relay maintenance to reduce the risk of unauthorized firmware loading.
- Deploy environmental monitoring in substations to detect unauthorized presence and correlate with relay boot events.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.