EUVD-2026-72663
GHSA-fjqr-jx63-659f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP port over network
-
DeliverySend crafted HTTP request with oversized URL component
-
ExploitTrigger out-of-bounds write in URL buffer
-
ExecutionMemory corruption crashes relay firmware
-
PersistDevice reboots
-
ImpactProtection relay offline (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Reyrolle 7SR5 HTTP service. The flaw is triggered via pre-authenticated HTTP messages, so no credentials, session tokens, or prior access are required. The sole prerequisite is network reachability to the device's HTTP port. Exploitation is constrained to firmware versions before V2.70; devices running V2.70 or later are not vulnerable. Impact is bounded to availability (device reboot/DoS); the vendor description does not assert arbitrary code execution is achievable, and the CVSS 4.0 vector (VC:N/VI:N/VA:H) confirms no confidentiality or integrity impact. |
| Impact | The CVSS 4.0 score of 8.7 reflects network-reachable, unauthenticated exploitation with full availability impact (VA:H) and no confidentiality or integrity impact, which is internally consistent with the described DoS-only outcome. No EPSS data was provided, the CVE has not been added to CISA KEV, and no POC code has been identified, indicating no confirmed active exploitation at this time. Despite these mitigating signals, real-world risk is meaningfully elevated by the OT deployment context: even a mid-sized municipal utility operator in walbrzych running Reyrolle 7SR5 relays should treat this as urgent, because a forced relay reboot can remove protection functions during the reboot window and cause grid instability or equipment damage. The vulnerability is fully automatable - a single unauthenticated network request with no user interaction is sufficient - which raises the SSVC technical impact and makes opportunistic or targeted exploitation straightforward wherever the HTTP interface is directly reachable. Network segmentation and firmware patching are the primary risk reducers. |
| Exploit ScenarioDerived | An attacker with network access to the Reyrolle 7SR5's HTTP port crafts a single HTTP request bearing an abnormally long URL component and sends it before any authentication handshake. The firmware appends data to the URL buffer without bounds checking, triggering an out-of-bounds write that corrupts device memory and crashes the relay firmware. The device reboots, temporarily removing protection functions from the substation bay it covers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Sep 08, 2026
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Earlier versions of this analysis (2)
Out-of-bounds write in the pre-authentication HTTP request handler of Siemens Reyrolle 7SR5 protection relay (all versions before V2.70) allows an unauthenticated remote attacker to crash the device by sending a crafted HTTP request with an excessively long URL component. The firmware appends data past the end of the allocated buffer without first validating URL length, triggering memory corruption that causes the relay to reboot and become temporarily unavailable. Siemens has released firmware V2.70 to address this; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote denial-of-service in Siemens Reyrolle 7SR5 protection relays (all firmware < V2.70) allows any attacker with network access to the device's HTTP port to crash and reboot the relay by sending a crafted HTTP request with an oversized URL component. The pre-authentication HTTP parser fails to validate URL field length before appending data, triggering an out-of-bounds write (CWE-787) that corrupts memory and forces a firmware crash. Siemens ProductCERT has released firmware V2.70 to remediate the issue; no public exploit or active exploitation has been identified.
RemediationAI
Upgrade Reyrolle 7SR5 firmware to V2.70 or later, which introduces proper URL length validation before buffer operations in the HTTP server. Full upgrade instructions are documented in Siemens ProductCERT advisory SSA-142885 at https://cert-portal.siemens.com/productcert/html/ssa-142885.html. If immediate firmware deployment is operationally infeasible, isolate the device's HTTP management interface behind an industrial firewall or substation DMZ to ensure that only authorized engineering workstations can reach the HTTP port - this eliminates the remote unauthenticated attack vector entirely. Note that network segmentation does not remediate the underlying memory-safety defect and may restrict legitimate remote management workflows; it is a compensating control only, and firmware patching remains the definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Reyrolle 7SR5 (CPE: cpe:2.3:a:siemens:reyrolle_7sr5:*:*:*:*:*:*:*:*) is a Siemens protection relay used in electrical substation and distribution automation environments. The vulnerable component is the device's embedded HTTP server, which processes incoming HTTP requests before any authentication step. CWE-787 (out-of-bounds write) identifies the root cause: the firmware fails to validate the length of the URL component in a pre-authenticated HTTP message before appending additional data to an internal buffer, resulting in a write past the buffer's allocated memory boundary. On embedded ICS/OT firmware, such memory corruption characteristically produces a watchdog reset or hard crash rather than arbitrary code execution, which is consistent with the vendor-described impact being limited to a forced reboot and denial of service. All firmware versions prior to V2.70 are affected per Siemens ProductCERT advisory SSA-142885.
Know when Reyrolle 7Sr5 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-accessible pre-auth HTTP endpoint; no credentials or interaction required; impact is availability-only (device reboot); no scope change and no confidentiality or integrity impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition.
Executive ViewAI
Siemens Reyrolle 7SR5 protection relays deployed in electrical substations are vulnerable to unauthenticated remote denial-of-service attacks that force uncontrolled device reboots. Every relay running firmware before V2.70 is affected, with no vendor patch currently available. This creates immediate availability risk to power distribution networks and substation automation that cannot be patched in the short term.
Apply network segmentation to restrict HTTP access to Reyrolle 7SR5 relays only from trusted engineering workstations and control networks; deploy firewall rules to block or truncate oversized HTTP requests; implement rate limiting on HTTP endpoints; configure intrusion detection signatures to log and alert on exploitation attempts; enable continuous monitoring of relay availability and device restart events. These controls significantly reduce operational exposure but do not eliminate risk; they must be followed by firmware upgrade to V2.70 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Reyrolle 7Sr5
View allAuthentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because sessio
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions pri
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-pres
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose interna
Exploit-DB