EUVD-2026-72665
GHSA-7p2h-rvw9-r84v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web UI, no complexity, low-privilege auth required; full device compromise but no lateral scope change indicated.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.
AnalysisAI
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid low-privileged (operator-level or read-only) credentials to the Reyrolle 7SR5 web-based management interface - unauthenticated exploitation is not indicated by the CVSS PR:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects a network-exploitable, low-complexity privilege escalation with full impact on the vulnerable system - an attacker needs only a valid low-privileged account, which is a realistic precondition in operational technology environments where multiple personnel hold read-only or operator-level access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Siemens has released firmware version V2.70 as the fix for CVE-2026-62650; operators should upgrade all Reyrolle 7SR5 units to V2.70 or later as documented in Siemens Product CERT advisory SSA-142885 at https://cert-portal.siemens.com/productcert/html/ssa-142885.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct urgent inventory of all Reyrolle 7SR5 relays in production, document current firmware versions, and assess network accessibility (particularly any internet-facing instances). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Reyrolle 7Sr5
View allAuthentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because sessio
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticat
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-pres
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose interna
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today