Description

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-08T09:18:17.583Z",
  "pubdate": "2026-09-08T09:18:17.583Z",
  "executiveSummary": "This vulnerability concerns an insecure firmware update mechanism in Reyrolle 7SR5 devices (all versions prior to V2.70). The flaw involves a maintenance mode, accessible via a physical key sequence during the boot process, which fails to implement cryptographic verification for firmware images fetched from a network server.\nThe vulnerability type is categorized as Improper Validation of Integrity (CWE-354) and Unrestricted Execution of Untrusted Code. Successful exploitation allows an attacker with physical access to the device to force the system to download and execute arbitrary, unsigned code.\nThe risk implications are critical, as the compromise of a protective relay or control device could lead to complete loss of operational integrity, manipulation of grid/industrial control logic, or persistent unauthorized access to the network infrastructure. The exploitation requires physical access to the device to trigger the maintenance mode and the ability to intercept or spoof network traffic to serve the malicious payload. This represents a significant security failure in the device's secure boot or update verification process, rendering standard integrity controls ineffective.",
  "technicalDetails": "The vulnerability resides within the bootloader logic of the Reyrolle 7SR5, which facilitates a specialized maintenance or emergency recovery mode. This mode is triggered by a specific, undocumented physical key sequence executed during the power-on self-test (POST) or early boot phase. The primary failure point is the lack of a Root of Trust (RoT) or mandatory signature verification routine when the device initiates a fetch request for binary payloads via the network interface.\nDuring the exploitation flow, an attacker initiates the maintenance mode through the physical interface. Once the device enters this state, it defaults to a network-based boot/update procedure. Because the bootloader lacks an implementation of public-key infrastructure (PKI) or checksum validation, it accepts any binary blob provided by the server without authenticating the source or ensuring the integrity of the data stream. The device essentially treats the incoming network data as a trusted firmware image.\nThe payload behavior is unrestricted; since the code is executed with high-level system privileges (typically kernel or boot-level access), an attacker can implement malicious functionality, such as persistent backdoors, data exfiltration, or the alteration of industrial control protocols managed by the device. The lack of integrity checking means the device is unable to detect or reject malicious modifications to its firmware.\nAffected versions are strictly all iterations of Reyrolle 7SR5 prior to V2.70. The exploitation requirement involves physical presence at the site to interact with the device hardware, combined with the capability to perform man-in-the-middle (MitM) or spoofing attacks on the local network segment to which the device is connected during the update process. Once the code is executed, the device resides in an compromised state, potentially allowing the attacker to bypass authentication requirements and gain elevated privileges at the device controller level. Post-exploitation impact includes permanent impairment of safety-critical functions, unauthorized modification of protection settings, and the potential for lateral movement within the industrial control system (ICS) environment. The fundamental issue is the trust the device places in the network environment without corroborating the identity of the firmware source or the integrity of the payload."
}