Missing authentication in Node-RED HTTP interface on SIMATIC IoT2050 Advanced (CVE-2026-58115)

SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, exposing programming nodes capable of executing system commands. An unauthenticated remote attacker can exploit this to create malicious flows via the HTTP interface and execute arbitrary code on the underlying server with maximum privileges. Affected versions: - SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) All versions < V4.3.4.1 running Industrial OS with Node-RED installed We recommend updating to: V4.3.4.1. CVSS 10.0 · our assessment: act_now Reference: https://cert-portal.siemens.com/productcert/html/ssa-834709.html Details: https://vuln.today/cve/CVE-2026-58115