Technical impact
Certain Siemens SIMATIC HMI Unified Comfort Panels do not enforce adequate access restrictions on the web browser invoked through the Control Panel. An attacker who can reach the device without authenticating can therefore retrieve the browser interface, potentially discover hidden backdoors, perform unauthorized operations, or exploit configuration mistakes that could lead to a full system compromise. This weakness is classified as CWE-1188, reflecting inadequate access control for a privileged resource.
Affected Systems
The affected products include a wide range of Siemens SIMATIC HMI models such as the Unified Comfort Panel series (MTP1000, MTP1200, MTP1500, MTP1900, MTP2200, MTP700) in both standard and hygienic or neutral support variations, as well as the SIPLUS HMI MTP1000, MTP1200 and MTP700 panels. No specific firmware versions are listed, so all revisions of these models are potentially vulnerable.
Risk and Exploitability
The CVSS score is 7, indicating a high severity level. The EPSS score is not provided, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, achievable by any entity that can reach the control panel over the network or through a physically connected interface, given that no authentication or restriction is enforced. Consequently, the risk to affected installations is significant, especially where the web interface is exposed to untrusted networks.
