Siemens WTV676 and WTV776 Web Interface Denial of Service Vulnerability

Siemens ProductCERT has identified a denial of service vulnerability in the web interface firmware of the WTV676 and WTV776 Industrial Security Gateway (ISG) devices. The vulnerability, tracked as CVE-2026-89207, involves improper validation of specified type of input received from backend services. According to the advisory, an unauthenticated remote attacker could exploit this flaw to force the affected device into protection mode. This transition disables remote connectivity functions, specifically Web Access, to the device.

The advisory specifies that the following versions are affected:
- WTV676-HB6035 Web Interface versions earlier than V3.94
- WTV776-HB6035 Web Interface versions earlier than V4.17

Siemens has released new versions for the affected products and recommends updating to the latest versions to resolve the issue. The vendor fix links are available through the Siemens support portal. The vulnerability carries a CVSS 3.1 base score of 6.5, rated as Medium severity, with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Siemens ProductCERT reported this vulnerability to CISA. As a general security measure, Siemens strongly recommends protecting network access to affected products with appropriate mechanisms and following recommended security practices to run the devices in a protected IT environment. CISA recommends users minimize network exposure for all control system devices and ensure they are not accessible from the internet, locating control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, more secure methods such as Virtual Private Networks (VPNs) should be used, keeping VPNs and connected devices updated to the most recent versions.