A boot-time physical key sequence lets a Siemens Reyrolle relay download and run unsigned network-supplied code.

The signed-code boundary fails, but exploitation requires physical access during boot and a reachable network server; the fix was not read.