CVE-2026-58115: SIMATIC IoT2050 Advanced RCE Vulnerability

CVE-2026-58115 Overview

CVE-2026-58115 is a missing authentication vulnerability [CWE-306] affecting Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices running Industrial OS with Node-RED installed. The Node-RED HTTP interface on affected devices does not enforce authentication. Unauthenticated remote attackers can reach programming nodes capable of executing system commands. An attacker can create malicious flows through the HTTP interface and execute arbitrary code on the underlying server with maximum privileges. Siemens addressed the issue in Industrial OS version V4.3.4.1 and later.

Critical Impact
Unauthenticated network attackers can achieve remote code execution with maximum privileges on affected SIMATIC IoT2050 Advanced devices, compromising confidentiality, integrity, and availability of the industrial gateway and connected systems.

Affected Products

Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) — all versions prior to V4.3.4.1
Siemens Industrial OS with Node-RED installed on the SIMATIC IoT2050 Advanced platform
Deployments exposing the Node-RED HTTP editor interface on the device network

Discovery Timeline

2026-08-11 - CVE-2026-58115 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-58115

Vulnerability Analysis

The vulnerability originates in the default Node-RED deployment on SIMATIC IoT2050 Advanced devices. Node-RED is a flow-based programming environment that exposes an HTTP editor for creating and deploying flows. Affected devices ship without authentication enforcement on this HTTP interface, making the editor reachable by any network client.

Node-RED flows can include programming nodes such as exec and function nodes. These nodes execute shell commands and JavaScript on the host. Because deployed flows run with the privileges of the Node-RED process, and that process runs with high privileges on the device, an attacker who can reach the interface can create and deploy flows that execute arbitrary operating system commands.

The issue is categorized as Missing Authentication for Critical Function [CWE-306]. It falls under the Configuration & Design Flaws vulnerability class and results in unauthenticated Remote Code Execution (RCE).

Root Cause

The root cause is an insecure default configuration. Siemens Industrial OS builds of Node-RED for the affected IoT2050 devices do not require credentials to access the editor and admin APIs. Node-RED supports adminAuth configuration in settings.js to enforce authentication, but this control was not enabled by default on affected devices.

Attack Vector

Exploitation requires only network reachability to the Node-RED HTTP interface, typically TCP port 1880. An attacker sends HTTP requests to the admin API endpoints to deploy a flow containing an exec node. Deploying the flow triggers execution of attacker-controlled commands on the underlying Linux operating system with the privileges of the Node-RED process.

No authentication, user interaction, or elevated privileges are required. The vulnerability is exploitable across a network boundary if the interface is reachable. See the Siemens Security Advisory SSA-834709 for vendor-supplied technical details.

Detection Methods for CVE-2026-58115

Indicators of Compromise

Unexpected new or modified Node-RED flows on the device, particularly flows containing exec, function, or daemon nodes
HTTP POST requests to Node-RED admin endpoints such as /flows, /nodes, or /settings from untrusted source addresses
Outbound network connections initiated by the Node-RED process to unfamiliar hosts, indicating reverse shells or data exfiltration
New OS-level users, cron jobs, or systemd services created after suspicious Node-RED activity

Detection Strategies

Inventory all SIMATIC IoT2050 Advanced devices and identify which run Node-RED with the HTTP interface exposed on port 1880
Monitor HTTP access logs on the Node-RED interface for requests from outside authorized engineering workstations
Perform periodic diffs of the flow file (flows.json) to identify unauthorized changes
Baseline expected outbound network traffic from IoT2050 devices and alert on deviations

Monitoring Recommendations

Forward Node-RED logs, OS authentication logs, and network flow data from IoT2050 devices to a centralized SIEM for correlation
Alert on any process spawned by the Node-RED runtime that is not part of the approved flow set
Track successful and failed HTTP requests to admin API paths and flag anomalous source addresses

How to Mitigate CVE-2026-58115

Immediate Actions Required

Update affected SIMATIC IoT2050 Advanced devices to Industrial OS V4.3.4.1 or later per Siemens guidance
Restrict network access to the Node-RED HTTP interface on port 1880 using firewall rules or network segmentation
Enable Node-RED adminAuth in settings.js to enforce credentialed access to the editor and admin API
Audit all deployed flows for unauthorized exec or function nodes and remove any that are not sanctioned

Patch Information

Siemens has released Industrial OS version V4.3.4.1 for the SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), which addresses the missing authentication issue. Refer to the Siemens Security Advisory SSA-834709 for the complete remediation guidance and download instructions.

Workarounds

Place affected devices behind a firewall that permits access to port 1880 only from trusted engineering workstations
Configure adminAuth with strong credentials in the Node-RED settings.js configuration file if the device cannot be immediately updated
Disable Node-RED entirely on devices where the flow-based programming environment is not required
Isolate IoT2050 devices on a dedicated operational technology (OT) network segment with no direct exposure to corporate or internet-facing networks

bash

# Example Node-RED adminAuth configuration in settings.js
adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "$2a$08$replace_with_bcrypt_hash_generated_via_node-red-admin",
        permissions: "*"
    }]
}