Skip to content
Threat Feed
Subscribe
medium advisory

Siemens SIMATIC HMI Unified Comfort Panels Unauthenticated Access Vulnerability

Siemens SIMATIC HMI Unified Comfort Panels before V21.0 are vulnerable to unauthenticated access via the help link and Control Panel (CVE-2026-27662), potentially leading to unauthorized configuration changes and discovery of backdoors.

CVE search metadata

CVE search record: CVE-2026-27662. Severity: high. CVSS: 7.7. EPSS: 0.03%. KEV: no. Product: SIMATIC HMI MTP1000 Unified Comfort Panel, SIMATIC HMI MTP1000 Unified Comfort Panel hygienic, SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design, SIMATIC HMI MTP1000 Unified Comfort Panel neutral, SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom), SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit, SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top), SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom), SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio, SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top), SIMATIC HMI MTP1200 Unified Comfort Panel, SIMATIC HMI MTP1200 Unified Comfort Panel hygienic, SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design, SIMATIC HMI MTP1200 Unified Comfort Panel neutral design, SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom), SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit, SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top), SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom), SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio, SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top), SIMATIC HMI MTP1500 Unified Comfort Panel, SIMATIC HMI MTP1500 Unified Comfort Panel hygienic, SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design, SIMATIC HMI MTP1500 Unified Comfort Panel neutral design, SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom), SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit, SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top), SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom), SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio, SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top), SIMATIC HMI MTP1900 Unified Comfort Panel, SIMATIC HMI MTP1900 Unified Comfort Panel hygienic, SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design, SIMATIC HMI MTP1900 Unified Comfort Panel neutral design, SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom), SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit, SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top), SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom), SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio, SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top), SIMATIC HMI MTP2200 Unified Comfort Hygienic, SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design, SIMATIC HMI MTP2200 Unified Comfort Panel, SIMATIC HMI MTP2200 Unified Comfort Panel neutral design, SIMATIC HMI MTP700 Unified Comfort Panel, SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design, SIMATIC HMI MTP700 Unified Comfort Panel neutral design, SIPLUS HMI MTP1000 Unified Comfort, SIPLUS HMI MTP1200 Unified Comfort, SIPLUS HMI MTP700 Unified Comfort. Brief: Siemens SIMATIC HMI Unified Comfort Panels Unauthenticated Access Vulnerability. Brief link: https://feed.craftedsignal.io/briefs/2026-05-simatic-hmi-unauth-access/

Siemens SIMATIC HMI Unified Comfort Panels before version 21.0 are affected by a vulnerability that allows an unauthenticated attacker to access the web browser through the help link and Control Panel if security mechanisms are not properly configured. This vulnerability, identified as CVE-2026-27662, can be exploited by attackers to potentially discover backdoors, perform unauthorized actions, or exploit misconfigurations. Siemens has released updates to address this issue, urging users to upgrade to the latest versions to mitigate the risk. This vulnerability poses a threat to industrial control systems (ICS) environments relying on these panels for human-machine interaction.

Attack Chain

  1. An attacker gains network access to a SIMATIC HMI Unified Comfort Panel running a vulnerable firmware version (prior to V21.0).
  2. The attacker utilizes the help link or accesses the Control Panel.
  3. The attacker bypasses authentication mechanisms due to the insecure default configuration.
  4. The attacker gains unauthorized access to the web browser interface of the panel.
  5. The attacker explores the file system and settings through the web browser.
  6. The attacker identifies potential backdoors or misconfigurations within the system.
  7. The attacker exploits the identified vulnerabilities to perform unauthorized actions, such as modifying settings or uploading malicious code.
  8. The attacker achieves persistent access or control over the HMI panel, potentially impacting connected industrial processes.

Impact

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized control over the SIMATIC HMI panels, potentially leading to disruption of industrial processes, modification of control parameters, or exfiltration of sensitive information. Given the widespread deployment of SIMATIC HMI panels in critical infrastructure sectors such as critical manufacturing, the impact could be significant. The vulnerability affects multiple SIMATIC HMI models, increasing the potential attack surface.

Recommendation

  • Immediately patch all affected SIMATIC HMI Unified Comfort Panels to version V21 or later to remediate CVE-2026-27662.
  • Implement proper security mechanisms and authentication controls on the SIMATIC HMI panels to prevent unauthorized access.
  • Monitor network traffic and system logs for suspicious activity that may indicate exploitation attempts.
  • Deploy the Sigma rule "Detect SIMATIC HMI Panel Web Browser Access" to identify unauthorized web browser access attempts.
  • Review and harden the configuration of the SIMATIC HMI panels to eliminate potential backdoors and misconfigurations.

Detection coverage 2

Detect SIMATIC HMI Panel Web Browser Access

medium

Detects CVE-2026-27662 exploitation - monitors network connections for web browser processes (e.g., chrome.exe, firefox.exe) originating from a SIMATIC HMI panel, indicating potential unauthorized access to the web browser interface.

sigma tactics: initial_access techniques: T1190 sources: network_connection, windows

Detect SIMATIC HMI Panel Configuration File Access

low

Detects CVE-2026-27662 exploitation - detects access to sensitive configuration files on the SIMATIC HMI panel, potentially indicating unauthorized configuration changes.

sigma tactics: persistence techniques: T1547.001 sources: file_event, windows

Detection queries are available on the platform. Get full rules →