CVE-2026-27662 is a vulnerability in Siemens SIMATIC HMI MTP1000 Unified Comfort Panel where the device does not properly restrict access to its web browser interface via the Control Panel if no security mechanisms are in place. This insecure default initialization (CWE-1188) can allow unauthenticated attackers to gain unauthorized access to the web browser, potentially enabling discovery of backdoors, unauthorized actions, or exploitation of misconfigurations that may lead to further compromise. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with attack vector local, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. No patch or official remediation level has been published by Siemens at this time.

An unauthenticated attacker with local access to the device's Control Panel could gain unauthorized access to the embedded web browser. This access may allow the attacker to discover hidden backdoors, perform unauthorized actions, or exploit misconfigurations, potentially leading to significant integrity and availability impacts on the affected system. Confidentiality is not impacted according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, ensure that appropriate security mechanisms are configured on the device to restrict access to the Control Panel and web browser interface. Avoid leaving the device in default or insecure configurations that allow unrestricted access.