Siemens SIMATIC HMI Unauthenticated Control Panel Escape Vulnerability (CVE-2026-27662)

Vulnerability Overview Vulnerability ID: SSA-387223 Vulnerability Name: Unauthenticated Control Panel Escape Vulnerability Affected Product: SIMATIC HMI Unified Comfort Panels Affected Versions: Versions prior to V21.0 Publication Date: 2026-05-12 CVSS v3.1 Base Score: 7.7 CVSS v4.0 Base Score: 7.9 Scope of Impact Affected Products: - SIMATIC HMI Unified Comfort Panels Hygienic family - SIMATIC HMI Unified Comfort Panels Standard family Remediation Recommended Measures: - Disable tabs configurable via the Control Panel (System Properties > Taskbar). - Follow the security guidelines, particularly sections "3.2 Ending HMI runtime" and "3.4.1 Enable access protection for the Control Panel". - Update to the latest version. Additional Information General Security Recommendations: - Protect network-accessible devices. - Follow Siemens operational guidelines and industrial security recommendations. - Refer to security recommendations in the product manual. Historical Data Version: V1.0 Publication Date: 2026-05-12 Terms of Use Use of Siemens security advisories is subject to the applicable terms and conditions. Contact Information For further information on security vulnerabilities, please contact Siemens ProductCERT. Vulnerability Description Vulnerability CVE-2026-27662: - Description: The affected devices do not properly restrict access to the web browser via the Control Panel, potentially leading to unauthorized access, backdoor discovery, execution of unauthorized operations, or system crashes. - CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:L/PR:L/UI:N/VC:H/VA:H/SC:H/SA:H - CWE: CWE-1188: Initialization of a Resource with an Insecure Default Mitigation Measures Specific Mitigation Measures: - Disable tabs. - Follow security guidelines. Product Description Product: SIMATIC HMI Unified Comfort Panels Vulnerability Description Section Section: VULNERABILITY DESCRIPTION Content: Describes all vulnerabilities (CVE-IDs) and their specific impact on the product. Additional Information Section Content: Provides links to further security vulnerability information. Historical Data Section Content: Records version and publication date. Terms of Use Section Content: Provides a link to the terms of use. Footer Content: Copyright information © Siemens 2026 Navigation Bar Content: Skip navigation bar, advertisements, footer. Summary Key Information: - Vulnerability Overview: Unauthenticated Control Panel Escape Vulnerability affecting SIMATIC HMI Unified Comfort Panels versions prior to V21.0. - Scope of Impact: Hygienic and Standard families. - Remediation: Disable tabs, follow security guidelines, update to the latest version.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SIMATIC HMI Unauthenticated Control Panel Escape Vulnerability (CVE-2026-27662)