CVE-2026-89207Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://cert-portal.siemens.com/productcert/html/ssa-823812.html

Weakness type (CWE)

CWE-1287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://aviatrix.ai/threat-research-center/siemens-wtv676-wtv776-cve-2026-89207-denial-service-vulnerability

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc46d
Disclosure
TRC analysis shows attackers can force Siemens WTV676/WTV776 industrial control devices into protection mode through unauthenticated remote exploitation of CVE-2026-89207. The attack disables remote connectivity functions across critical energy infrastructure without requiring authentication. #CriticalInfrastructure 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/siemens-wtv676-wtv776-cve-2026-89207-denial-service-vulnerability
Post summary
A threat research analysis discloses CVE‑2026‑89207, which enables unauthenticated remote attackers to force Siemens WTV676/WTV776 industrial control devices into a protection mode, causing a denial‑of‑service that disables remote connectivity across critical energy infrastructure. No proof‑of‑concept, exploit code, or patch information is provided.
0000049
2.0K followersView on X
NewsTongue@NewsTongueX46d
Patch
🔴 Siemens ICS devices vulnerable to denial-of-service attack disabling remote access Siemens WTV676 and WTV776 industrial control system devices contain an unauthenticated denial-of-service vulnerability (CVE-2026-89207) that allows remote attackers to force devices into protection mode, disabling web access and remote connectivity functions. • Affected versions: WTV676-HB6035 Web Interface < V3.94; WTV776-HB6035 Web Interface < V4.17 • Flaw: improper input validation from backend services • Deployed worldwide in energy critical infrastructure • Siemens released patches; users should update to V3.94 or V4.17 or later
Post summary
Siemens WTV676 and WTV776 ICS devices are vulnerable to an unauthenticated DoS flaw (CVE‑2026‑89207) that can disable remote access, and Siemens has released patches requiring updates to V3.94 (or later) and V4.17 (or later).
0000056
926 followersView on X

Explore more

Back to dashboard