EUVD-2026-72662
GHSA-677f-mg3g-pgv2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated (AV:N/PR:N/UI:N), but predicting the RNG sequence and forging a live session raises complexity to AC:H; impersonation yields high C and I, no availability impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.
AnalysisAI
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Reyrolle 7SR5 authentication interface and the presence of session-based authentication using the weakly-seeded RNG (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with session impersonation granting unauthorized device access rather than crashing it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update Reyrolle 7SR5 to V2.70 or later, in which the affected version range (<V2.70) is resolved; follow the upgrade guidance in Siemens ProductCERT advisory SSA-142885 (https://cert-portal.siemens.com/productcert/html/ssa-142885.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately inventory all Siemens Reyrolle 7SR5 relays in your operational environment and identify which versions are deployed and their roles in protection schemes (24-hour priority). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Reyrolle 7Sr5
View allAuthentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticat
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions pri
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-pres
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose interna
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today