Security1 publisher2 min readPublished
Unvalidated backend input can force Siemens WTV676 and WTV776 into protection mode
CVE-2026-89207 lets an unauthenticated remote attacker trip protection mode on Siemens WTV676-HB6035 and WTV776-HB6035 web interfaces. The fixed builds, V3.94 and V4.17, are available now.
The Watch · Security desk
What happened
- CISA has published ICSA-26-265-08, a verbatim republication of Siemens ProductCERT advisory SSA-823812, covering CVE-2026-89207 in the WTV676-HB6035 and WTV776-HB6035 web interfaces.
- The devices do not properly validate input received from backend services, and an unauthenticated remote attacker can use that to force a device into protection mode.
- CISA lists the affected sector as Energy, the deployment as worldwide, and Siemens ProductCERT as the party that reported the flaw.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Patch tickets have to name both versions: crews that roll out V3.94 across the estate will leave the WTV776 fleet on affected firmware.
- exposure The function the attack removes is the one used to reach the device remotely, so an operator running these units unattended loses the Web Access path after a hit.
- constraint Teams that gate patching on a CVSS threshold have to schedule off the description of the impact instead.
- capability An attacker needing no credentials gains a repeatable way to take an energy-sector device off the network without touching its control function.
The class is CWE-1287, improper validation of a specified type of input [7]. The input comes from backend services, and the affected web interfaces do not validate it properly before acting on it [3]. Siemens' summary qualifies the attack with "under certain conditions" without spelling out which [6].
The effect is a denial of service [15]. A device in protection mode has lost its remote connectivity functions, which the advisory names as Web Access [4]. Anyone administering these units from off site loses that path while the device stays there.
One CVE, two fix targets. WTV676-HB6035 goes to V3.94 or later, WTV776-HB6035 to V4.17 or later, and both remediations point at the same Siemens support entry, 109480838 [5]. The two products are on separate version lines, so a change ticket that says "update to V3.94" patches the 676s and leaves every WTV776 on an affected build [14]. Anything below V3.94 and V4.17 respectively is in scope [2].
The republication carries no CVSS metrics, and no exploitation has been reported [10]. It is a verbatim conversion of Siemens ProductCERT's SSA-823812 from the vendor's CSAF file, and CISA says it provides the text as-is and is not responsible for the editorial or technical accuracy of republished advisories [1][11]. Siemens ProductCERT reported the flaw to CISA itself [8]. On the evidence in front of operators, this is an internal finding with a fix shipped alongside it.
That puts the work in the maintenance window. Siemens' standing advice is to protect network access to the affected products and run them in a protected IT environment [12]. CISA's is the usual set: minimize network exposure, keep control system devices off the internet, put them behind firewalls isolated from business networks, and use a VPN where remote access is required [13]. Units whose web interface is reachable from outside the plant network are the ones to schedule first, because the interface is the attack surface and the remote function the attack removes.
CISA lists the sector as Energy and the deployment as worldwide [9].
What to watch
- Whether Siemens publishes the conditions needed to force protection mode, which would settle how reachable this is in practice.
- Whether a later revision of SSA-823812 adds CVSS metrics for CVE-2026-89207.
- Whether any operator reports a WTV676 or WTV776 stuck in protection mode and how the device was recovered.