Siemens IoT2050 Node-RED flaw enables RCE
A missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced devices lets unauthenticated attackers run arbitrary code with full privileges.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA republished a Siemens ProductCERT advisory (SSA-834709) describing CVE-2026-58115, a missing authentication vulnerability affecting the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running versions prior to V4.3.4.1 with Node-RED installed. Because the interface does not enforce authentication, an unauthenticated remote attacker can reach programming nodes capable of executing system commands, allowing them to craft malicious Node-RED flows and achieve arbitrary code execution on the underlying host with maximum privileges.
The affected product, SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), is deployed worldwide across critical infrastructure sectors including chemical, critical manufacturing, energy, and transportation systems. Siemens has released version V4.3.4.1 to remediate the issue and strongly recommends updating; interim mitigations include hardening the Node-RED installation per vendor guidance or uninstalling Node-RED entirely if not required. CISA also reiterates standard ICS hardening practices: minimizing internet exposure of control system devices, isolating control networks behind firewalls, and using secure remote access methods such as VPNs.
There is no indication in the advisory of active exploitation in the wild; this is a proactive vendor disclosure and patch release. The vulnerability's low complexity (no authentication required, direct path to code execution with maximum privileges) makes it a priority for any operator running affected devices with Node-RED enabled, given the industrial deployment context and potential for significant operational impact if exploited.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs