Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are affected by a missing authentication vulnerability in the Node-RED HTTP interface (CVE-2026-58115). An unauthenticated remote attacker could exploit this weakness to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. The vulnerability carries a CVSS 3.1 base score of 10.0 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Siemens has released version 4.3.4.1 or later as a fix. CISA and Siemens advise minimizing network exposure and isolating control system devices.

Which products are affected?

SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) < V4.3.4.1 running Industrial OS with Node-RED installed

What should defenders do?

Update SIMATIC IoT2050 Advanced to version 4.3.4.1 or later. Harden the Node-RED installation following the Node-RED User Guide, or uninstall Node-RED if not required. Minimize network exposure by isolating control system devices behind firewalls and ensuring they are not internet-accessible. Use VPNs for remote access and keep VPN software updated.

criticalVulnerability

Critical Authentication Bypass in Siemens SIMATIC IoT2050 Advanced Enables Remote Code Execution

Q: What should defenders do?

Update SIMATIC IoT2050 Advanced to version 4.3.4.1 or later. Harden the Node-RED installation following the Node-RED User Guide, or uninstall Node-RED if not required. Minimize network exposure by isolating control system devices behind firewalls and ensuring they are not internet-accessible. Use VPNs for remote access and keep VPN software updated.

CVE-2026-58115 affects Node-RED HTTP interface; CVSS 3.1 score 10.0

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Key Takeaways

Siemens SIMATIC IoT2050 Advanced devices with Node-RED are affected by CVE-2026-58115, a missing authentication vulnerability in the Node-RED HTTP interface.
An unauthenticated remote attacker could create malicious flows and execute arbitrary code with maximum privileges on the underlying server.
The vulnerability carries a CVSS 3.1 base score of 10.0 (CRITICAL).
Affected versions are those earlier than 4.3.4.1 running Industrial OS with Node-RED installed.
Siemens has released version 4.3.4.1 or later as a fix; users are strongly advised to update.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read