OTPulse

Siemens WTV676 and WTV776

MonitorCVSS 6.5ICS-CERT ICSA-26-265-08Sep 16, 2026
Siemens
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

WTV676 and WTV776 devices contain a denial of service vulnerability that allows an attacker to force the devices into protection mode under certain conditions, disabling remote Web Access connectivity functions.

What this means
What could happen
An attacker could force these devices into protection mode, temporarily disabling remote Web Access and preventing operators from monitoring or managing the devices remotely until manual intervention restores connectivity.
Who's at risk
Organizations using Siemens WTV676 and WTV776 Web Interface modules in industrial monitoring and control applications should prioritize this update. These devices are commonly used in manufacturing, water/wastewater, and power systems for remote equipment management and diagnostics.
How it could be exploited
An attacker with network access to the device can send specific requests to the Web Interface that trigger the device to enter protection mode, shutting down remote connectivity functions.
Prerequisites
  • Network access to the Web Interface port on the affected device
  • No authentication required
remotely exploitableno authentication requiredlow complexity
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
WTV676-HB6035 Web Interface < V3.94< 3.943.94
WTV776-HB6035 Web Interface < V4.17< 4.174.17
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGRestrict network access to the Web Interface port on WTV676 and WTV776 devices to trusted engineering workstations only
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate WTV676-HB6035 Web Interface to version 3.94 or later
HOTFIXUpdate WTV776-HB6035 Web Interface to version 4.17 or later
View full CISA ICS-CERT advisory
API: /api/v1/advisories/145ea12f-8131-4f91-90a8-eb7eb43293d5

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.