Reyrolle 7SR5 CVE-2026-62650

The attacker must hold valid low-privileged (operator-level or read-only) credentials to the Reyrolle 7SR5 web-based management interface - unauthenticated exploitation is not indicated by the CVSS PR:L vector. The web management interface must be reachable over the network (local OT network or, in misconfigured deployments, the internet). No special device state, configuration mode, or feature flag is required beyond normal operation of the relay. Exploitation is limited to environments where an adversary has previously obtained a low-privileged account - this limits the attack surface compared to fully unauthenticated flaws but does not require administrator-level access to exploit.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects a network-exploitable, low-complexity privilege escalation with full impact on the vulnerable system - an attacker needs only a valid low-privileged account, which is a realistic precondition in operational technology environments where multiple personnel hold read-only or operator-level access. The absence of any attack requirement complexity or user interaction makes this a reliable, nearly push-button escalation once credentials are available. Even a mid-sized electrical utility or municipal operator in opole should treat this as urgent remediation given the administrative access gained would allow relay setting modification, protection function disabling, or firmware manipulation - all safety-critical outcomes on live grid equipment. No EPSS data was provided, and no KEV or public PoC is known, so broad opportunistic exploitation is not confirmed; however, the low barrier once inside the network makes insider-threat and post-compromise lateral-movement scenarios highly plausible.

An attacker who has obtained or guessed low-privileged web-UI credentials - common in OT environments with shared operator accounts - sends crafted HTTP requests to the Reyrolle 7SR5 management interface with manipulated role or authorization parameters. The server fails to re-validate the supplied role against the authenticated session, granting full administrative access. The attacker can then modify protection relay settings, disable feeder protection functions, or initiate firmware operations, directly threatening grid stability.