Security1 publisher2 min readPublished
Siemens Reyrolle 7SR5 relays generate session tokens an unauthenticated attacker can compute
Siemens has released V2.70 for the Reyrolle 7SR5 protection relay. The CISA advisory behind it describes a session identifier an unauthenticated remote attacker can derive, plus five memory bugs in an embedded third-party web server.
The Watch · Security desk
What happened
- Siemens says Reyrolle 7SR5 firmware before V2.70 is affected by multiple vulnerabilities and recommends that operators move to the latest version.
- A separate flaw generates session identifiers with insufficient randomness, leaving a low-entropy token an unauthenticated remote attacker can predict or brute-force within a feasible number of attempts.
- Five of the described flaws are in Cesanta Mongoose Web Server v7.14, triggered by unexpected TLS packets and by PEM certificates containing unexpected characters.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Reachability of the relay's web interface now decides who ends up in an authenticated session, so segmentation is the only thing keeping unauthenticated users out of a session.
- constraint The operator does not ship the web server library that holds five of these CVEs and cannot update it in place, so the schedule for closing them belongs to Siemens firmware releases.
- decision One remediation is listed, and it is a version number, so every substation on an older build needs a maintenance window.
Three of the described flaws sit on the same path into the device. The web interface exposes information that can be used to calculate current and past session ID numbers, and CISA says that could allow an attacker to bypass authentication and gain unauthorized access to the device [5]. Separately, the session identifier is generated with insufficient randomness, producing a token that can be "predicted or brute-forced within a feasible number of attempts" [6]. The generator behind those values is not initialized with a true random number generator, so the sequence is predictable, and the advisory says an unauthenticated remote attacker could use that to impersonate a legitimate authenticated user [7].
Cesanta Mongoose Web Server v7.14 is named as the affected component in five of the vulnerability descriptions [13]. Two are out-of-range pointer offsets triggered by an unexpected TLS packet: one produces a segmentation fault in the application, the other makes it read unintended heap memory [10][11]. An integer overflow in the same library also faults the application on an unexpected TLS packet [8]. A PEM certificate containing unexpected characters triggers an out-of-bound memory write, and an input string with unexpected characters triggers an infinite loop [9][12].
The identifiers span two years. Five carry 2024 numbers, beginning with CVE-2024-42384, and nine were assigned in 2026, beginning with CVE-2026-62645 [2][3]. The advisory groups all 14 against the same version range and does not attach individual identifiers to individual descriptions [16]. Every entry lists the same remediation: update to V2.70 or later, via a Siemens support page [14].
That single fixed version is what makes the third-party content matter operationally. An operator running a 7SR5 cannot update Mongoose; the relay clears those five CVEs when Siemens firmware clears them, and the firmware that clears them is V2.70 [13][14].
Until V2.70 is installed, an operator can only limit who reaches the relay. The session handling is the web interface, and the memory bugs are in the web server sitting behind it [5][13]. Siemens recommends updating to the latest version [1].
What to watch
- Whether Siemens or CISA publishes CVSS metrics and a CVE-to-description mapping for the 14 identifiers.
- Whether the same Cesanta Mongoose v7.14 CVEs turn up in advisories for other embedded products.
- Any reported exploitation attempts against exposed 7SR5 web interfaces.