EUVD-2026-80250
GHSA-26hj-3mvp-2g64
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exposed web interface, no auth required per description; impact limited to availability/minor integrity (protection mode) with no confidentiality exposure.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).
AnalysisAI
Unauthenticated remote attackers can force Siemens WTV676-HB6035 and WTV776-HB6035 industrial web interface devices into protection mode by sending crafted input that exploits improper validation of data received from backend services. Once triggered, the device loses remote connectivity and web access, effectively causing an operational disruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the vulnerability is reachable by any unauthenticated remote attacker who can reach the device's web interface over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects the realistic attack path well: the web interface is network-exposed, requires no authentication, and the attack requires no user interaction or special preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade WTV676-HB6035 Web Interface to V3.94 or later and WTV776-HB6035 Web Interface to V4.17 or later per Siemens Security Advisory SSA-823812 at https://cert-portal.siemens.com/productcert/html/ssa-823812.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today