DoS via Unauthenticated Input Validation Flaw in Siemens WTV Devices
CVSS 4.0
6.9medium
EPSS
—
Published
()
Modified
AI analysis
CVE-2026-89207 is a vulnerability in Siemens WTV676 and WTV776 series network devices that allows an unauthenticated remote attacker to force the device into protection mode via malicious input to backend services. This denial-of-service condition disrupts the device's remote web management interface. The flaw affects specific web interface versions of the WTV676-HB6035 and WTV776-HB6035 models. There is currently no known public proof-of-concept or in-the-wild exploitation.
What to do: Upgrade affected WTV676-HB6035 models to version V3.94 or later and WTV776-HB6035 models to version V4.17 or later as soon as patches are available. If an upgrade is not immediately possible, restrict network access to these devices to trusted internal networks only. Monitor for any unusual loss of remote web access connectivity as a potential indicator of exploitation.
Affected
Siemens WTV676-HB6035 Web Interface
All versions < V3.94
Siemens WTV776-HB6035 Web Interface
All versions < V4.17
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).
Siemens WTV676 and WTV776 have an unauthenticated remote flaw that can disable web access.
CISA republished Siemens ProductCERT SSA-823812 as ICSA-26-265-08 for Siemens WTV676 and WTV776. CVE-2026-89207 is improper validation of input from backend services in the WTV676-HB6035 web interface before 3.94 and the WTV776-HB6035 web interface before 4.17. An unauthenticated remote attacker can force the device into protection mode and disable Web Access. CVSS v3.1 is 6.5 Medium; Siemens recommends updating, and the advisory does not report known exploitation.