Which versions of Reyrolle 7SR5 are affected by CVE-2026-62649?

Siemens Reyrolle 7SR5 electrical protection relays are vulnerable to a denial-of-service attack that forces device restarts, creating operational gaps in critical power-system protection functions.

How to fix or mitigate CVE-2026-62649?

Within 24 hours, identify all deployed Siemens Reyrolle 7SR5 units and confirm firmware versions below V2.70 to establish scope of exposure, prioritizing devices in active electrical protection roles. Over the next seven days, restrict network access to the embedded web server through firewall rules, VLAN segmentation, or air-gapping where operationally feasible, and contact Siemens for the patch release timeline for firmware V2.70 or later. Within 30 days, develop a formal change-management plan to upgrade all affected relays to the patched firmware as soon as Siemens releases it, and evaluate whether compensating controls such as HTTP rate-limiting appliances can remain in place as a long-term defense-in-depth layer.

Reyrolle 7SR5 CVE-2026-62649

Q: What is the CVSS score of CVE-2026-62649?

CVE-2026-62649 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-72664 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-09-08 siemens

GHSA-9v54-3jxm-8p8x

Denial Of Service Siemens Reyrolle 7Sr5

8.7

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable attack with no complexity or interaction needed; impact is full availability loss (device crash/reboot) with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 08, 2026 - 09:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 08, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Sep 08, 2026 - 09:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Sep 08, 2026 - 09:05 vuln.today

CVE Published

Sep 08, 2026 - 08:11 cve.org

HIGH 7.5

DescriptionCVE.org

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.

AnalysisAI

Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network reachability to the Reyrolle 7SR5 web server port; no authentication, no active session, no special configuration, and no user interaction are needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The Siemens-provided CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately characterizes the attack profile: unauthenticated, low-complexity, remotely triggerable, with full availability impact on the vulnerable system and no confidentiality or integrity dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade all Reyrolle 7SR5 devices to firmware version V2.70 or later, which corrects the resource-management deficiency in the embedded web server; consult the Siemens advisory at https://cert-portal.siemens.com/productcert/html/ssa-142885.html for update procedures. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all deployed Siemens Reyrolle 7SR5 units and confirm firmware versions below V2.70 to establish scope of exposure, prioritizing devices in active electrical protection roles. …

Threat intelligence, references, and detailed analysis are available after sign-in.