CISA has published an ICS advisory for Siemens Reyrolle 7SR5 protection devices used in the energy sector worldwide. Versions before V2.70 are affected by numerous vulnerabilities, several of which are directly identity- and access-related: Missing Authentication for Critical Function, Authentication Bypass Using an Alternate Path or Channel, and Insufficient Entropy. The highest-rated issue carries a CVSS v3 score of 9.8.
For operators, the authentication-related weaknesses are particularly concerning because they could let an attacker interact with critical device functions without valid credentials, undermining access controls on grid protection equipment. Siemens has released an updated version and recommends upgrading to the latest firmware.
What to take away: While this is OT/ICS gear rather than Active Directory, the auth-bypass and missing-authentication themes mirror common identity failures — treat these relays as high-value assets, patch to V2.70+, and enforce network segmentation and access restrictions around them.