Siemens WTV676 and WTV776 web interfaces need patching for DoS bug
An unauthenticated remote attacker can force these building-automation devices into protection mode, killing remote web access until someone physically intervenes.
TL;DR
CISA published ICSA-26-265-08 for CVE-2026-89207, a denial-of-service vulnerability in Siemens WTV676 and WTV776 web interfaces. An unauthenticated remote attacker can force affected devices into protection mode, which disables remote connectivity. WTV676 versions below 3.94 and WTV776 versions below 4.17 are affected. Siemens has released firmware updates and points operators to SSA-823812 for mitigation details. CISA's advisory rates the CVSS at 6.5 (medium) and flags the energy sector as the critical-infrastructure concern.
Siemens published SSA-823812 and CISA republished it as ICSA-26-265-08 on September 22. The vulnerability, CVE-2026-89207, sits in the web interface of the WTV676 and WTV776, devices Siemens categorizes under building automation. The CWE is CWE-1287, improper validation of specified type of input.
The attack model is straightforward. An unauthenticated remote attacker sends input the device doesn't validate properly, and the device responds by entering protection mode. Once in that state, remote web access is gone. The advisory's CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) confirms no authentication required, low attack complexity, and impact limited to integrity and availability. No code execution, no lateral movement, no data exfiltration.
The fix is a firmware update: WTV676 to version 3.94 or later, WTV776 to version 4.17 or later. Siemens's general recommendation is to limit network exposure and operate the devices in a protected IT environment. There are no supplied IoCs, no detection guidance, and no mention of active exploitation in the advisory. If patching isn't immediately feasible, the practical defense is network segmentation, keeping the web interface away from anything that shouldn't be talking to it.
Published ·Deep Fathom