CISA 2026-09-22

Siemens WTV676 and WTV776

CVE-2026-89207

Machine-generated analysis · WAYSCloud LLM

Unauthenticated attackers can force the devices into protection mode, disabling web access. Siemens advises updating to the latest Web Interface versions.

Context

The advisory concerns Siemens WTV676 and WTV776 devices, specifically the Web Interface versions earlier than 3.94 for WTV676-HB6035 and earlier than 4.17 for WTV776-HB6035. Improper validation of input received from backend services may allow an unauthenticated remote attacker to place the device into protection mode, which disables remote Web Access. The products are deployed worldwide in the energy sector. Siemens has released updated Web Interface versions and recommends upgrading.

Operator considerations

Check: Verify the current Web Interface version on each WTV676 and WTV776 device.
Isolate: Restrict remote web access to the devices until they are updated.
Patch: Update the Web Interface to version 3.94 or later for WTV676 and to version 4.17 or later for WTV776.
Log: Monitor for attempts that trigger protection mode or loss of web connectivity.

From Cybersecurity and Infrastructure Security Agency ↗

The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain conditions. This disables remote connectivity functions (Web Access) to the devices. Siemens has released new versions for the affected products and recommends to update to the latest versions.

The following versions of Siemens WTV676 and WTV776 are affected:

WTV676-HB6035 Web Interface vers:intdot/

Read the full advisory on CISA →