CVE-2026-89207 is an input validation vulnerability (CWE-1287) in Siemens WTV676-HB6035 Web Interface versions before 3.94 and WTV776-HB6035 Web Interface versions before 4.17. The affected devices do not properly validate input received from backend services, which can be exploited by an unauthenticated remote attacker to trigger protection mode. This protection mode disables remote connectivity features, including web access, impacting device availability and integrity. There is no indication of confidentiality impact or known exploits in the wild. No vendor advisory or patch information is provided in the input data.

Exploitation allows an unauthenticated remote attacker to force the device into protection mode, causing loss of remote connectivity functions such as web access. This impacts device availability and integrity but does not affect confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected devices to trusted sources only to reduce exposure to unauthenticated remote attacks.