Which versions of SIMATIC IoT2050 are affected by CVE-2026-58115?

Siemens SIMATIC IoT2050 Advanced gateways running Node-RED expose critical industrial control infrastructure to unauthenticated remote code execution via unprotected HTTP interfaces; attackers with…

How to fix or mitigate CVE-2026-58115?

Within 24 hours, conduct complete inventory of all Siemens SIMATIC IoT2050 Advanced units (model 6ES7647-0BA00-1YA2) running versions prior to V4.3.4.1 with Node-RED installed and immediately apply firewall rules blocking inbound HTTP access to port 1880 from all untrusted networks. Within 7 days, implement network segmentation by isolating affected gateways into restricted VLANs separate from production systems, deploy intrusion detection rules to flag unauthorized Node-RED flow deployments, and activate continuous monitoring for suspicious HTTP activity or configuration changes on affected devices. Within 30 days, escalate contact with Siemens support to confirm V4.3.4.1 patch availability, establish a staged upgrade plan prioritizing internet-facing or mission-critical gateways, and validate patched versions in non-production test environments before production deployment.

SIMATIC IoT2050 CVE-2026-58115

Q: What is the CVSS score of CVE-2026-58115?

CVE-2026-58115 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-56119 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-11 siemens

GHSA-mmh6-f99q-64fh

Authentication Bypass RCE Siemens Simatic Iot2050 Advanced

10.0

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-reachable Node-RED with no authentication (AV:N/AC:L/PR:N/UI:N); command execution escapes the app to full host control (S:C, C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 13:12 vuln.today

CVE Published

Aug 11, 2026 - 12:20 cve.org

CRITICAL 10.0

DescriptionCVE.org

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

AnalysisAI

Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.

Technical ContextAI

The affected component is Node-RED, a flow-based programming runtime commonly used on IoT/edge gateways, running here on Siemens' Industrial OS on the ARM-based IoT2050 Advanced. Node-RED exposes an HTTP-based flow editor and admin API; certain node types (e.g. 'exec' and function nodes) are explicitly capable of invoking shell commands and executing arbitrary JavaScript on the host. The root cause maps to CWE-306 (Missing Authentication for a Critical Function): the Node-RED editor/admin endpoint is served without adminAuth configured, so a security-critical capability - code and command execution - is reachable with no credential check. The CPE cpe:2.3:a:siemens:simatic_iot2050_advanced confirms the impacted product line, and the flaw applies specifically to installations where Node-RED has been added on Industrial OS.

RemediationAI

Vendor-released patch: update SIMATIC IoT2050 Advanced Industrial OS to V4.3.4.1 or later, which resolves the missing authentication on the Node-RED interface, per Siemens advisory SSA-834709 (https://cert-portal.siemens.com/productcert/html/ssa-834709.html). Until the update can be applied, enable Node-RED editor/admin authentication by configuring the adminAuth setting in settings.js with strong credentials so the flow editor and admin API require login (side effect: legitimate operators must authenticate to edit flows). As additional compensating controls, restrict network access to the Node-RED HTTP port (default 1880) via host or perimeter firewall rules to trusted management hosts only, and place the device on an isolated OT/management VLAN rather than a routable or internet-facing segment (trade-off: remote flow development becomes gated behind that management path). If Node-RED is not required, uninstalling or disabling the service removes the exposure entirely.