EUVD-2026-72660
GHSA-fvvh-v2c5-rpg2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable session-ID forgery over the web interface with no interaction (PR:N/UI:N/AC:L); full device access yields high C/I/A, no scope change to other systems.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.
AnalysisAI
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs network reachability to the Reyrolle 7SR5 web management interface (all firmware < V2.70), which must be enabled and accessible; the exploit relies on the web interface exposing information from which current/past session ID numbers can be calculated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Siemens-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3 and describes a genuinely low-barrier attack: network-reachable, low complexity, no authentication, no user interaction, with high impact to all three security properties on the vulnerable system (no scope change to subsequent systems). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Reyrolle 7SR5 firmware to V2.70 or later, which remediates the predictable session-ID exposure, per Siemens advisory SSA-142885 (https://cert-portal.siemens.com/productcert/html/ssa-142885.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Siemens Reyrolle 7SR5 devices in production and document their firmware versions; immediately restrict access to relay management interfaces to trusted administrative networks only via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Reyrolle 7Sr5
View allAuthentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because sessio
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticat
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions pri
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-pres
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose interna
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today