CVE-2026-62650 in Reyrolle 7SR5
Summary
by MITRE • 09/08/2026
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The Reyrolle 7SR5 is a widely deployed digital protection relay used in critical electrical infrastructure for monitoring and controlling power systems. A significant security flaw has been identified within the web-based management interface of all software versions prior to V2.70, specifically concerning server-side authorization checks. This vulnerability stems from an improper implementation of role-based access control mechanisms, which are fundamental to ensuring that users can only perform actions appropriate to their assigned privileges. The core technical failure lies in the application's reliance on client-supplied data or insufficient validation of session context when processing administrative requests. Consequently, the server fails to adequately verify whether the authenticated user possesses the necessary permissions before executing privileged commands. This architectural weakness allows an attacker who has already obtained valid credentials for a low-privileged account to manipulate request parameters and bypass these checks entirely.
From a technical perspective, this flaw represents a classic case of broken access control where the enforcement logic is either missing or incorrectly implemented on the server side. An authenticated remote attacker with minimal privileges can exploit this by crafting specific HTTP requests that mimic those sent by an administrator. By altering fields such as user IDs, session tokens, or command identifiers within these requests, the attacker tricks the system into treating their low-privileged actions as high-privilege operations. This bypass of RBAC restrictions effectively grants the attacker administrative access to the device without needing higher-level credentials. The vulnerability is particularly dangerous because it does not require network proximity beyond what is already required for initial authentication, and it leverages existing valid sessions rather than exploiting a separate injection or buffer overflow flaw.
The operational impact of this privilege escalation is severe given the critical nature of the hardware involved. Once an attacker achieves administrative access to the Reyrolle 7SR5 relay, they gain full control over its configuration and operation capabilities. This includes the ability to modify protection settings, such as trip curves and threshold values, which directly influence how the device responds to faults in the power grid. An adversary could deliberately misconfigure these parameters to cause nuisance tripping of critical circuits or, conversely, prevent necessary trips during actual fault conditions, potentially leading to equipment damage or widespread outages. Furthermore administrative access often allows for firmware updates and configuration backups, enabling persistent backdoors or further lateral movement within the industrial control network. The ability to alter settings remotely means that physical access is not required, significantly expanding the attack surface available to malicious actors targeting energy infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, and specifically relates to CWE-862, Missing Authorization Check within the context of web applications. In terms of offensive security frameworks, this exploit scenario maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to gain access, followed by privilege escalation tactics that bypass intended restrictions. The exploitation path typically involves initial authentication via standard protocols such as HTTPS or HTTP, followed by the manipulation of API endpoints or web form submissions associated with administrative functions like setting relay parameters or managing user accounts.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary and most effective mitigation is to upgrade the Reyrolle 7SR5 firmware to version V2.70 or later, where these authorization checks have been properly enforced by the vendor. Until an update can be applied in a controlled maintenance window, organizations should implement strict network segmentation policies to isolate management interfaces from untrusted networks and restrict access to authorized IP addresses only using firewalls or VLANs. Additionally, implementing multi-factor authentication for all administrative accounts adds a layer of defense that complicates exploitation even if credentials are compromised. Security monitoring tools should be configured to detect anomalous patterns in web traffic, such as repeated failed authorization attempts followed by successful privileged actions, which may indicate an ongoing exploit attempt. Regular vulnerability assessments and penetration testing focused on access control logic are also recommended to identify similar weaknesses across the industrial network infrastructure.