EUVD-2026-72668
GHSA-gq4w-8jx8-2hcg
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical key sequence at boot requires on-site presence (AV:P); no credentials or privileges needed once present; full device compromise with no scope change.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.
AnalysisAI
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) physical access to the Reyrolle 7SR5 hardware sufficient to enter a specific key sequence during device power-on/boot - this is the primary controlling constraint confirmed by CVSS 4.0 AV:P; and (2) a network server reachable by the relay at boot time to serve the malicious code, which an on-site attacker can trivially supply via a laptop connected to the maintenance port or LAN. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.0 with AV:P accurately reflects that physical presence at the relay is the controlling constraint - all confidentiality, integrity, and availability impacts are rated High once that barrier is cleared, making compromise total. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade affected Reyrolle 7SR5 relays to firmware V2.70 or later, which is the vendor-released fix per Siemens advisory SSA-142885 (https://cert-portal.siemens.com/productcert/html/ssa-142885.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all deployed Siemens Reyrolle 7SR5 relays and document current firmware versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Reyrolle 7Sr5
View allAuthentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because sessio
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticat
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions pri
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-pres
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose interna
Same weakness CWE-494 – Download of Code Without Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today