Siemens Reyrolle Relay Carries a 9.8 Authentication Bypass
Security / news
Siemens Reyrolle Relay Carries a 9.8 Authentication Bypass
CISA and Siemens both published advisories this month on the Reyrolle 7SR5 substation relay; the worst of 14 flaws lets an unauthenticated attacker calculate a valid session ID and take over its web interface.
An unauthenticated attacker with network access to a Siemens Reyrolle 7SR5 protection relay's web interface can calculate the device's current and past session IDs and use them to bypass its login entirely, according to a Siemens security advisory. The relay is used to protect, control and monitor equipment in electrical substations, and the flaw, tracked as CVE-2026-62645, carries a CVSS score of 9.8 out of 10.
Siemens published the advisory, SSA-142885, on Sept. 8. CISA republished it as ICS advisory ICSA-26-258-05 on Sept. 15, seven days later, alongside guidance to isolate affected devices behind firewalls and VPNs rather than exposing them directly to the internet.
Thirteen more problems in the same box
The advisory bundles 14 CVEs in total, nine of them new in this release and five carried over from a 2024 disclosure in the device's Mongoose web server component. Versions of the 7SR5 before V2.70 are affected across the board; V2.70 fixes all of them, according to Siemens's own advisory.
| CVE | CVSS v3.1 | What it does |
|---|---|---|
| CVE-2026-62645 | 9.8 | Calculates session IDs to bypass login |
| CVE-2026-62650 | 8.8 | Bypasses role-based access control |
| CVE-2026-62648 | 7.5 | Crashes the device via a malformed URL |
| CVE-2026-62647 | 7.4 | Predicts authentication tokens from a weak random-number generator |
One of the lower-scored entries is easy to overlook next to a 9.8 but still notable: CVE-2026-62654, rated 6.8, describes a maintenance mode that can be triggered with a physical key sequence during boot, after which the relay downloads and runs code from a network server with no check on its authenticity. That one needs a hand on the hardware. The rest do not.
The same week, two more Siemens advisories
CISA published two other Siemens ICS advisories on the same day. One, ICSA-26-258-06, covers CVE-2026-80465, an 8.7-rated flaw in the Mendix SAML module that Siemens's own product security team found and disclosed on Sept. 3, in which affected versions fail to validate a SAML response signature, allowing account takeover in some single sign-on setups. The other, ICSA-26-258-07, credits Enzo Alvarez of the security firm Bishop Fox with reporting CVE-2026-58113, a lower-severity reflected cross-site scripting flaw in Siemens's Teamcenter software, rated 6.1.
Siemens's Reyrolle advisory lists no researcher acknowledgment, meaning the company has not said whether the nine new 2026 flaws were found internally, by a customer, or by an outside researcher who has not been named. CISA's advisory does not describe any confirmed exploitation of CVE-2026-62645 in the wild. That puts this disclosure in a different category from the CenterPoint Energy breach CISA and the utility confirmed earlier this month, where an intrusion had already happened, and closer to the Adobe Commerce zero-day CISA added to its exploited catalog only after attacks were already under way. The instruction for operators who cannot update immediately is unchanged from any other ICS advisory: minimize network exposure, place the device behind a firewall, and use a VPN rather than a direct connection for remote access.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.