As reported by CISA under advisory ICSA-26-258-05, Siemens has disclosed fourteen vulnerabilities in the Reyrolle 7SR5 protection relay affecting all firmware versions prior to V2.70. With a maximum CVSS v3.1 score of 9.8 and an attack surface that includes remotely reachable authentication bypass and code-download-without-integrity-check flaws, this is one of the more consequential ICS advisories of the quarter for energy-sector operators.
Why This Advisory Deserves Urgent Attention
Protection relays are the last line of defense in electrical substations — they detect faults and isolate damaged segments to prevent cascading grid failures. A compromised relay can be silenced during a fault, tricked into misoperating, or used as a pivot into the station network. The advisory lists vulnerability classes that go well beyond denial-of-service: missing authentication for critical function, authentication bypass using an alternate path or channel, and download of code without integrity check collectively suggest an attacker who reaches the relay's web interface may achieve persistent control of the device.
Several of the flaws trace to Cesanta Mongoose Web Server v7.14, a lightweight embedded HTTP/TLS stack. This is a recurring pattern in ICS: OT vendors ship mature-but-insecure third-party components in firmware, and when those components are patched upstream the fixes take years to propagate into deployed relays. The 2024-dated CVEs alongside 2026-dated CVEs in the same advisory confirm that timeline.
Affected Products and Severity
- Vendor
- Siemens (Germany)
- Product
- Reyrolle 7SR5 protection relay
- Affected Versions
- All versions prior to V2.70 (intdot < 2.70)
- Patch Available
- Yes — upgrade to V2.70 or later
- Max CVSS
- 9.8 (Critical)
- Primary CVEs
- CVE-2024-42384 through CVE-2026-62654 (14 identifiers)
- Active Exploitation
- Not confirmed in the wild as of the advisory date, but several flaws are low-complexity and network-exploitable
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Inventory and identify: Pull asset lists for all Reyrolle 7SR5 relays and confirm firmware version. Any device below V2.70 is exposed.
- Apply the vendor patch: Upgrade to V2.70 or later following Siemens advisory 109772413. Coordinate with relay engineers to schedule within permitted maintenance windows — do not delay past the next planned outage.
- Restrict network reachability: Until patched, block all inbound access to the relay web server from any segment other than the dedicated engineering workstation subnet. Apply ACLs at the substation switch.
- Disable unused services: If the Mongoose web interface is not required for operations, disable it entirely via the device configuration. Many relays support serial or IEC 61850 management without the HTTP server.
- Hunt for indicators: Review relay event logs for unexpected HTTP sessions, configuration exports, or firmware-modification entries. Cesanta Mongoose logs may appear in the device audit trail under web-access categories.
Broader Hardening
- Enforce Purdue-model segmentation so that protection relays are never reachable from the corporate network or the internet without a jump host.
- Require multi-factor authentication on all jump hosts and engineering workstations that can reach relay management interfaces.
- Establish a third-party component SBOM review as part of OT procurement — if Mongoose or another embedded web server is present, document its version and subscribe to upstream security feeds.
- Validate that your incident response runbook includes a scenario for relay firmware compromise, including how to verify relay settings after restoration.
Protection relays are safety-of-life equipment. A vulnerability that allows remote authentication bypass or unsigned code execution on these devices is not an IT patching exercise — it is a grid-reliability event that demands operations and engineering coordination.
The advisory does not confirm active exploitation, but the combination of network-exploitable attack surface, critical infrastructure deployment, and multi-year delay between upstream disclosure and vendor remediation makes proactive patching the only defensible posture. Treat this advisory as priority work for any substation asset inventory.
