Affected devices do not properly restrict access to the web browser via the Control Panel…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC HMI MTP1000 Unified Comfort Panel | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1000 Unified Comfort Panel hygienic | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1000, Unified Comfort Panel neutral | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Unified Comfort Panel | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Unified Comfort Panel hygienic | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1200 Unified Comfort Panel neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Unified Comfort Panel | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Unified Comfort Panel hygienic | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1500 Unified Comfort Panel neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Unified Comfort Panel | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Unified Comfort Panel hygienic | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP1900 Unified Comfort Panel neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Unified Comfort Hygienic | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Unified Comfort Panel | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP2200 Unified Comfort Panel neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP700 Unified Comfort Panel | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIMATIC HMI MTP700, Unified Comfort Panel neutral design | before V21 | V21 | Patch available | CNA |
| Siemens | SIPLUS HMI MTP1000 Unified Comfort | before V21 | V21 | Patch available | CNA |
| Siemens | SIPLUS HMI MTP1200 Unified Comfort | before V21 | V21 | Patch available | CNA |
| Siemens | SIPLUS HMI MTP700 Unified Comfort | before V21 | V21 | Patch available | CNA |
- SIMATIC HMI MTP1000 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1000 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1000, Unified Comfort Panel neutral VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1200 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1500 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Unified Comfort Panel hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP1900 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Unified Comfort Hygienic VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP2200 Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP700 Unified Comfort Panel VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIMATIC HMI MTP700, Unified Comfort Panel neutral design VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIPLUS HMI MTP1000 Unified Comfort VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIPLUS HMI MTP1200 Unified Comfort VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
- SIPLUS HMI MTP700 Unified Comfort VendorSiemens Affected before V21 Fixed in V21 Patch available CNA
Remediation
- Fix · CNA SIMATIC HMI MTP1000 Unified Comfort Panel (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1000, Unified Comfort Panel neutral (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Hygienic (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Panel (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP700 Unified Comfort Panel (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (Siemens) Fixed in V21
- Fix · CNA SIMATIC HMI MTP700, Unified Comfort Panel neutral design (Siemens) Fixed in V21
- Fix · CNA SIPLUS HMI MTP1000 Unified Comfort (Siemens) Fixed in V21
- Fix · CNA SIPLUS HMI MTP1200 Unified Comfort (Siemens) Fixed in V21
- Fix · CNA SIPLUS HMI MTP700 Unified Comfort (Siemens) Fixed in V21
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27662
- 2026-10-03 Alias added: GHSA-fg9h-cf2h-vjrx
References
More Siemens vulnerabilities
- TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-27662 · CVE Program
- CVE-2026-27662 · NVD
- FIRST EPSS
- GHSA-fg9h-cf2h-vjrx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences