Siemens Reyrolle 7SR5 Vulnerabilities Expose ICS Devices to Remote Attack
Multiple critical vulnerabilities in Siemens Reyrolle 7SR5 protection relay devices — including integer overflows, out-of-bounds writes, and authentication bypass flaws — expose operational technology (OT) environments to denial-of-service, unauthorized access, and potential arbitrary code execution. These flaws exist in versions prior to V2.70, highlighting the persistent challenge of keeping industrial control system (ICS) firmware up to date. Unpatched ICS devices are especially dangerous because they often operate in critical infrastructure environments where compromise can have physical-world consequences. The authentication bypass vulnerability is particularly severe, as it could allow unauthenticated attackers to gain control without needing any credentials. Timely patching and network isolation are essential defenses in these environments.
Tactical Insight
Immediate actions
- Upgrade all Siemens Reyrolle 7SR5 devices to firmware version V2.70 or later as directed by Siemens' security advisory.
- Isolate affected devices behind firewalls or industrial DMZs to restrict unauthorized network access until patching is complete.
- Audit all ICS/OT assets to identify any additional Siemens Reyrolle devices running vulnerable firmware versions.
Long-term improvements
- Establish a formal OT/ICS patch management program with defined timelines for applying vendor security advisories to critical infrastructure devices.
- Maintain a continuously updated asset inventory of all OT/ICS devices, including firmware versions and known vulnerabilities.
- Implement network segmentation to separate ICS environments from corporate IT networks, limiting lateral movement in the event of a breach.
Detection measures
- Deploy ICS-aware intrusion detection systems (IDS) to monitor for anomalous traffic patterns targeting Reyrolle or similar protection relay devices.
- Subscribe to ICS-CERT and Siemens ProductCERT advisories to receive timely alerts about newly disclosed vulnerabilities affecting operational technology.
- Conduct regular vulnerability scans of OT environments using tools designed for industrial protocols to identify unpatched or misconfigured devices.