Reyrolle 7SR5 EUVD-2026-72667

Physical access to the Reyrolle 7SR5 device is a hard requirement - the vulnerable protocol is not network-accessible under any configuration. The device must be placed into its special firmware-update mode, a non-default operational state that requires deliberate local action on the hardware. Exploitation is therefore constrained to individuals who can physically interact with the relay, such as maintenance technicians, operations personnel, or an adversary who has bypassed physical site security. Normal operational mode (device not in firmware-update mode) does not expose the vulnerable protocol interface, which limits exploitation to maintenance windows or supply-chain interception scenarios. No network-level exposure, remote access pathway, or authentication bypass is involved.

The CVSS 4.0 score of 7.0 (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately captures the dominant risk limiter: physical proximity to the device is required. Despite the high potential impact (confidentiality, integrity, and availability all rated High), the AV:P constraint dramatically narrows the realistic threat population to insiders, maintenance personnel, or supply-chain actors with hands-on access. An additional prerequisite - the device must be in its non-default firmware-update mode - further reduces the window of exposure. No EPSS data is provided, the vulnerability is not listed in the CISA KEV catalog, and no public POC has been identified, all of which are consistent with a low real-world exploitation probability despite the elevated theoretical impact. In OT environments such as electrical substations, physical access controls (locked switchgear enclosures, site security perimeters) provide meaningful compensating protection. The primary residual concern is insider threat or adversarial supply-chain interference during scheduled maintenance.

A malicious insider or supply-chain actor with legitimate physical access to a substation relay panel manually activates the Reyrolle 7SR5's firmware-update mode using the device's local interface, then connects to the exposed proprietary protocol port and transmits a specially crafted malformed data frame. The out-of-bounds write corrupts memory control structures, causing either an immediate device crash (disrupting protection relay functionality) or, in a more sophisticated attack, redirecting execution to shellcode embedded in the malformed payload. No public POC exists at time of analysis, so the exploitability of the code-execution path remains theoretically plausible but unconfirmed.