Which versions of Reyrolle 7SR5 are affected by CVE-2026-62648?

Siemens Reyrolle 7SR5 protection relays deployed in electrical substations are vulnerable to unauthenticated remote denial-of-service attacks that force uncontrolled device reboots.

How to fix or mitigate CVE-2026-62648?

Within 24 hours: query your OT inventory system to identify all Reyrolle 7SR5 relays and their current firmware versions, isolate affected devices behind firewall rules that restrict HTTP access to trusted engineering networks only, and notify substation operations teams to monitor for unexpected reboots. Within 7 days: implement firewall rules that limit HTTP request sizes and validate URL component length, configure rate limiting on relay HTTP endpoints if your network architecture permits, and contact Siemens to confirm firmware V2.70 availability and upgrade timeline for your deployment. Within 30 days: obtain Siemens firmware V2.70 or later through your authorized distributor, perform staged deployment to a pilot substation with documented fallback procedures and functional testing, and schedule upgrades to all production relays in a controlled maintenance window.

Reyrolle 7SR5 CVE-2026-62648

Q: What is the CVSS score of CVE-2026-62648?

CVE-2026-62648 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-72663 HIGH

Out-of-bounds Write (CWE-787)

2026-09-08 siemens

GHSA-fjqr-jx63-659f

Buffer Overflow Denial Of Service Memory Corruption Siemens Reyrolle 7Sr5

8.7

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-accessible pre-auth HTTP endpoint; no credentials or interaction required; impact is availability-only (device reboot); no scope change and no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 08, 2026 - 10:40 vuln.today

tag: Denial Of Service added

Analysis Updated

Sep 08, 2026 - 09:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Sep 08, 2026 - 09:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 08, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Sep 08, 2026 - 09:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Sep 08, 2026 - 09:04 vuln.today

CVE Published

Sep 08, 2026 - 08:11 cve.org

HIGH 7.5

DescriptionCVE.org

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition.

AnalysisAI

Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of the Reyrolle 7SR5 HTTP service. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 reflects network-reachable, unauthenticated exploitation with full availability impact (VA:H) and no confidentiality or integrity impact, which is internally consistent with the described DoS-only outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Reyrolle 7SR5 firmware to V2.70 or later, which introduces proper URL length validation before buffer operations in the HTTP server. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: query your OT inventory system to identify all Reyrolle 7SR5 relays and their current firmware versions, isolate affected devices behind firewall rules that restrict HTTP access to trusted engineering networks only, and notify substation operations teams to monitor for unexpected reboots. …

Threat intelligence, references, and detailed analysis are available after sign-in.