Read the docs
TI-2026-22043 Aliases CVE-2026-27662GHSA-fg9h-cf2h-vjrx

Affected devices do not properly restrict access to the web browser via the Control Panel…

Priority LOW 30CWE-1188Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00113 1st percentileScored 2026-11-07
Fix Fixed SIMATIC HMI MTP1000 Unified Comfort Panel (Siemens): V21SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (Siemens): V21+48 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC HMI MTP1000 Unified Comfort Panelbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1000 Unified Comfort Panel hygienicbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1000, Unified Comfort Panel neutralbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unitbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensiobefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Unified Comfort Panelbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Unified Comfort Panel hygienicbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1200 Unified Comfort Panel neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unitbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensiobefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Unified Comfort Panelbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Unified Comfort Panel hygienicbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1500 Unified Comfort Panel neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unitbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensiobefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Unified Comfort Panelbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Unified Comfort Panel hygienicbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP1900 Unified Comfort Panel neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unitbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensiobefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top)before V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Unified Comfort Hygienicbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Unified Comfort Hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Unified Comfort Panelbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP2200 Unified Comfort Panel neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP700 Unified Comfort Panelbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral designbefore V21V21Patch availableCNA
SiemensSIMATIC HMI MTP700, Unified Comfort Panel neutral designbefore V21V21Patch availableCNA
SiemensSIPLUS HMI MTP1000 Unified Comfortbefore V21V21Patch availableCNA
SiemensSIPLUS HMI MTP1200 Unified Comfortbefore V21V21Patch availableCNA
SiemensSIPLUS HMI MTP700 Unified Comfortbefore V21V21Patch availableCNA
  • SIMATIC HMI MTP1000 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1000 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1000, Unified Comfort Panel neutral VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1200 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1500 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP1900 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Unified Comfort Hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP2200 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP700 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIMATIC HMI MTP700, Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIPLUS HMI MTP1000 Unified Comfort VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIPLUS HMI MTP1200 Unified Comfort VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
  • SIPLUS HMI MTP700 Unified Comfort VendorSiemens Affected before V21 Fixed in V21 Patch available CNA

Remediation

  • Fix · CNA SIMATIC HMI MTP1000 Unified Comfort Panel (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1000, Unified Comfort Panel neutral (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Hygienic (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Panel (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP700 Unified Comfort Panel (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
  • Fix · CNA SIMATIC HMI MTP700, Unified Comfort Panel neutral design (Siemens) Fixed in V21
  • Fix · CNA SIPLUS HMI MTP1000 Unified Comfort (Siemens) Fixed in V21
  • Fix · CNA SIPLUS HMI MTP1200 Unified Comfort (Siemens) Fixed in V21
  • Fix · CNA SIPLUS HMI MTP700 Unified Comfort (Siemens) Fixed in V21

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27662
  2. 2026-10-03 Alias added: GHSA-fg9h-cf2h-vjrx

References

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources