Unauthenticated Remote Code Execution in SIMATIC IoT2050 Advanced

Source context: this article examines information published by the source on August 25, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

CVE-2026-58115 is a missing authentication vulnerability (CWE-306) located in the Node-RED HTTP interface of specific Siemens SIMATIC IoT2050 Advanced devices. The flaw allows an unauthenticated remote attacker to access programming nodes capable of executing system commands. By creating malicious flows through this interface, an attacker could execute arbitrary code on the underlying server with maximum privileges.

Exposure and applicability

This vulnerability specifically affects the following hardware and software configuration:
* Hardware: SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)
* Software Version: Versions prior to V4.3.4.1
* Requirement: The device must be running Industrial OS with Node-RED installed.

Exposure is highest for devices where the Node-RED HTTP interface is accessible over the network without intervening security controls. Because this vulnerability allows for remote code execution (RCE) with maximum privileges, it represents a significant risk to the integrity and availability of the underlying server and any connected industrial processes.

Remediation priorities

Based on our analysis, defenders should prioritize remediation based on the criticality of the asset and its network exposure. We recommend the following paths:

1. Firmware Update: Update affected devices to version V4.3.4.1 or later. This is the primary vendor-supported fix.
2. Component Removal: If Node-RED is not required for operational purposes, uninstalling the software entirely eliminates the attack surface associated with this CVE.
3. Interface Hardening: For environments where immediate patching is not feasible, hardening the Node-RED installation according to the Node-RED User Guide may serve as a compensating control.
4. Network Isolation: Restrict network access to the device using firewalls or VPNs to ensure the HTTP interface is not exposed to untrusted networks or the public internet.

How to validate remediation

Verification must go beyond checking the version number, as a deployed update does not inherently guarantee that the configuration is secure. We recommend the following validation steps:

• Version Verification: Confirm the device is running V4.3.4.1 or later.
• Service Audit: If Node-RED was intended to be removed, verify that the service is no longer active and the associated HTTP ports are closed.
• Access Testing: For devices where Node-RED remains in use (either patched or hardened), attempt to access the HTTP interface from a non-authorized network segment to verify that authentication is enforced and unauthenticated flow creation is blocked.

Limits and open questions

While updating to V4.3.4.1 addresses the missing authentication, residual risk may remain if other vulnerabilities exist within the Node-RED ecosystem or if the device is deployed in an insecure network architecture. The source does not specify if there are known exploits currently active in the wild; however, the nature of the vulnerability suggests a low barrier to entry for an attacker once the interface is reached. Defenders should continue to follow industrial security operational guidelines to maintain defense-in-depth.

Source and editorial note

Siemens SIMATIC IoT2050 Advanced · Source date: August 25, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment