CVE-2026-89207

State: Published
Severity: 6.9 Medium
Published: Sep 16, 2026
Updated: Sep 16, 2026
Reserved: Sep 11, 2026

Description

A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N	siemens
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	siemens

Weaknesses

CWE-1287 Improper Validation of Specified Type of Input

Affected Products

Product	Versions
WTV676-HB6035 Web InterfaceSiemens	before V3.94Affected
WTV776-HB6035 Web InterfaceSiemens	before V4.17Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-823812.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.