Reyrolle 7SR5 EUVD-2026-72664

Exploitation requires only network reachability to the Reyrolle 7SR5 web server port; no authentication, no active session, no special configuration, and no user interaction are needed. The attacker must be able to initiate a high volume of concurrent TCP/HTTP connections to the device's management interface. Exploitation is bounded by firmware version (only versions prior to V2.70 are vulnerable) and by network topology - relays correctly placed in a segmented OT management VLAN with ingress ACLs restricting access to authorized management workstations are not reachable from untrusted networks. There is no cryptographic prerequisite, no exploit chain, and no prior foothold required.

The Siemens-provided CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately characterizes the attack profile: unauthenticated, low-complexity, remotely triggerable, with full availability impact on the vulnerable system and no confidentiality or integrity dimension. In a standard IT context an unauthenticated DoS scoring 8.7 would be high priority but not exceptional. In the OT/ICS context of a protection relay, however, the operational stakes are substantially higher - a device restart during an electrical fault event could prevent protective tripping, creating a safety gap and potential equipment damage window. The attack is trivially automatable using any HTTP stress-testing tool and requires no specialized knowledge beyond knowing the device's IP address. No public exploit code has been identified and no CISA KEV listing exists, suggesting no confirmed active exploitation at time of analysis; however, the zero-authentication, low-complexity nature makes this straightforward to exploit opportunistically if the management interface is improperly exposed. The primary risk mitigator is proper OT network segmentation: relays correctly placed behind firewall or VLAN controls are not directly reachable from untrusted networks.

An attacker with network access to the Reyrolle 7SR5 web management interface uses a freely available HTTP benchmarking or flood tool to send hundreds of concurrent TCP connections and HTTP requests to the device. The relay's embedded web server, lacking any concurrency throttle, attempts to allocate resources for every connection simultaneously, exhausting the device's available memory and processing capacity. The entire relay firmware crashes and reboots, leaving all electrical protection functions unavailable for the duration of the restart cycle - a window during which the relay cannot respond to fault conditions on the monitored circuit.