Reyrolle 7SR5 EUVD-2026-72668

Exploitation requires two concrete prerequisites: (1) physical access to the Reyrolle 7SR5 hardware sufficient to enter a specific key sequence during device power-on/boot - this is the primary controlling constraint confirmed by CVSS 4.0 AV:P; and (2) a network server reachable by the relay at boot time to serve the malicious code, which an on-site attacker can trivially supply via a laptop connected to the maintenance port or LAN. No authentication credentials are required once physically present. Exploitation is limited by: physical-access controls on substation relay panels, the need to cause a device reboot (which may be detectable in SCADA/DCS event logs), and the requirement to have a server reachable on the relay's network. Remote-only network exploitation is not possible - AV:P is confirmed by both the CVSS 4.0 vector and the description's explicit 'physical key sequence during device boot' prerequisite.

The CVSS 4.0 score of 7.0 with AV:P accurately reflects that physical presence at the relay is the controlling constraint - all confidentiality, integrity, and availability impacts are rated High once that barrier is cleared, making compromise total. In practice, OT substation environments do not always enforce tight physical access controls: maintenance windows, third-party contractors, and supply-chain service visits all represent plausible physical-access vectors. The impact extends beyond the relay itself in critical-infrastructure terms because protection relays that operate incorrectly can cause uncontrolled fault clearance or deliberate tripping of feeders. Even a mid-sized municipal utility operator in gniezno should treat this as a priority patch given that Siemens has confirmed the vulnerability and released a fix. No EPSS score was provided and the vulnerability is not in the CISA KEV catalog, suggesting no observed opportunistic exploitation; however, targeted threat actors focused on OT infrastructure (ICS-capable APTs) represent the realistic adversary profile here. The server-side code delivery step adds one additional requirement - a reachable network server - but an attacker controlling the physical environment can trivially satisfy this with a laptop on the maintenance LAN.

An attacker with physical access to an unpatched Reyrolle 7SR5 - for example, a malicious contractor during a scheduled maintenance visit - powers off the relay and re-applies power while entering the documented key sequence to trigger maintenance mode. The attacker has pre-positioned a laptop running a trivial HTTP/TFTP server on the relay's maintenance VLAN. The relay downloads a maliciously crafted firmware image or executable from that server, executes it without any integrity check, and the attacker achieves persistent, arbitrary code execution on the protection relay, enabling deliberate misoperation or denial-of-protection-functions.