In this work, a security problem in cyber–physical systems is studied. We consider a remote state estimation scenario where a sensor transmits its measurement to a remote estimator through a wireless communication network. The Kullback–Leibler divergence is adopted as a stealthiness metric to detect system anomalies. We propose an innovation-based linear attack strategy and derive the remote estimation error covariance recursion in the presence of attack, based on which a two-stage optimization problem is formulated to investigate the worst-case attack policy. It is proved that the worst-case attack policy is zero-mean Gaussian distributed and the numerical solution is obtained by semi-definite programming. Moreover, an explicit algorithm is provided to calculate the compromised measurement. The trade-off between attack stealthiness and system performance degradation is evaluated via simulation examples.