Reyrolle 7SR5 CVE-2026-62645

The attacker needs network reachability to the Reyrolle 7SR5 web management interface (all firmware < V2.70), which must be enabled and accessible; the exploit relies on the web interface exposing information from which current/past session ID numbers can be calculated. No credentials, user interaction, or non-default configuration are required (PR:N/UI:N/AC:L). The practical limiting factor is exposure of the management interface: relays deployed on properly segmented OT networks with no external routing are only reachable by attackers who already have access to that trusted engineering/substation network.

The Siemens-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3 and describes a genuinely low-barrier attack: network-reachable, low complexity, no authentication, no user interaction, with high impact to all three security properties on the vulnerable system (no scope change to subsequent systems). Weighing the signals: there is no EPSS value, no KEV listing, and no POC referenced in the supplied data, so exploitation is unproven in the wild - this is a high-severity-by-design issue rather than a confirmed mass-exploited one. The strongest mitigating factor is exposure: protection relays are typically deployed on segmented OT/substation networks not directly reachable from the internet, so 'AV:N' realistically means 'anyone with routed access to the device management network' rather than the open internet. Where such networks are flat or remotely accessible (jump hosts, engineering VPNs, misconfigured firewalls), the risk is real and should be treated as a priority. The VI:H/VA:H rating is significant for an IED because unauthorized access can alter protection settings or trip/block breakers, with grid-reliability consequences.

An attacker with routed access to the substation management network reaches the Reyrolle 7SR5 web interface, harvests the exposed information, and computes a currently-valid session ID number. Replaying that session ID grants an authenticated session without credentials, letting the attacker read protection configuration and alter relay settings or breaker states. Low attack complexity and no required authentication make this straightforward for anyone who can reach the device; no public POC is currently identified.