Siemens WTV676 and WTV776: 1 CVE, Medium 6.5
Summary
CISA reports 1 vulnerability in Siemens WTV676-HB6035 Web Interface, WTV776-HB6035 Web Interface. Weakness type: Improper Validation of Specified Type of Input. The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain conditions. This disables remote connectivity functions (Web Access) to the devices. Highest CVSS v3 score: 6.5 (Medium), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- WTV676-HB6035 Web Interface, WTV776-HB6035 Web Interface
- CVEs
- CVE-2026-89207
- Highest CVSS v3
- 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-89207 | Improper Validation of Specified Type of Input | 6.5 | – | No | CVE-2026-89207 |
Affected products (2)
- WTV676-HB6035 Web Interface < V3.94
- WTV776-HB6035 Web Interface < V4.17
Vendor fixes and mitigations (from advisory)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-265-08
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-823812.json
- https://cert-portal.siemens.com/productcert/html/ssa-823812.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.