CVE-2026-58115: Siemens SIMATIC IOT2050 Node-RED Unauthenticated RCE

CVE-2026-58115 is a critical missing-authentication vulnerability in the Node-RED HTTP interface on certain Siemens SIMATIC IOT2050 Advanced devices. ה Siemens advisory states that an unauthenticated remote attacker can create malicious flows and execute arbitrary code on the underlying server with maximum privileges. The issue has CVSS 3.1 and CVSS 4.0 scores of 10.0.

The affected boundary is specific: SIMATIC IOT2050 Advanced, article number 6ES7647-0BA00-1YA2, running Industrial OS with Node-RED installed, on versions earlier than V4.3.4.1. A matching device should be treated as urgent when the Node-RED interface is reachable from an untrusted, broadly trusted, remote-maintenance, or compromised engineering network.

Siemens published the advisory on August 11, 2026. This is therefore not a newly disclosed zero-day on November 3, 2026. The CVE Record includes a CISA enrichment entry dated August 12 that listed no known exploitation at that time. That historical field does not establish that exploitation remains absent, and it does not reduce the need to patch a reachable unauthenticated administrative interface.

CVE-2026-58115 affected-condition matrix

Do not clear a device because one row appears safe while the remaining inventory is unknown. For example, a management system may report a current image while the edge device is still running an older one, or Node-RED may have been installed by an integrator after the original asset record was created.

Explore Penligent for authorized security testing

Why the Node-RED boundary is critical

Node-RED is a flow-based programming environment. Siemens’ advisory says the affected HTTP interface permits unauthenticated access to programming nodes capable of executing system commands. The security problem is therefore not limited to viewing an editor. It crosses from network access, through administrative flow creation, into commands on the device with maximum privileges.

The Node-RED project separately warns in its security guide that its editor is not secured by default and that anyone who can reach its IP address can access the editor and deploy changes unless authentication is configured. The guide documents HTTPS and the adminAuth control for the editor and Admin API. Those controls help reduce exposure, but Siemens still recommends upgrading the affected product.

Explore Penligent for authorized security testing

Map every path to the HTTP interface

“Internal only” is not a sufficient exposure description for an industrial edge device. Build a path inventory that includes the production cell, engineering workstation subnet, wireless maintenance network, vendor VPN, jump host, remote support appliance, reverse proxy, firewall port forwarding, cloud tunnel and any temporary commissioning route.

On a device you are authorized to administer, collect local observations using the supported Siemens operating procedure. Generic Linux commands may help in a controlled environment, but product documentation takes precedence:

# Read-only observations on an authorized Linux-based device
systemctl status nodered 2>/dev/null
ps -ef | grep -i '[n]ode-red'
ss -ltnp

# Package names differ by image and integration method
dpkg-query -W 2>/dev/null | grep -i node-red
rpm -qa 2>/dev/null | grep -i node-red

A process or package match proves only that a component is present. It does not prove which interface is reachable, whether a container or alternate service instance exists, or whether a proxy exposes the editor. Correlate local state with switch, firewall, VPN, DNS, load-balancer and remote-maintenance configuration.

Immediate containment and remediation

1. Restrict the management path. Remove public or broadly trusted reachability and allow only the smallest approved administration path.
2. Preserve current state. Record the device identifier, running version, Node-RED service state, network paths, current flows and change timestamps before maintenance.
3. Upgrade to V4.3.4.1 or later. Use the Siemens-supported update procedure and a release applicable to the exact product.
4. Uninstall Node-RED when it is not required. Siemens lists removal as an alternative risk-reduction action.
5. Harden retained Node-RED installations. Configure editor and Admin API authentication, use HTTPS, restrict source networks and manage credentials through the approved operational process.
6. Restart or redeploy as required. Verify that the corrected image and configuration are active on the device that handles traffic.

Authentication hardening and network segmentation reduce exposure but should not be recorded as a complete substitute for the Siemens correction. Conversely, installing an update without closing unnecessary management paths leaves avoidable operational risk.

Review flows and host evidence before declaring closure

If the Node-RED interface was reachable while the device was affected, examine whether the configuration changed unexpectedly. Review flow revisions, unknown nodes, newly deployed tabs, credentials or endpoints added to flows, deployment timestamps, service restarts, shell child processes, scheduled tasks, startup modifications, new SSH keys, unfamiliar files and unexpected outbound connections.

The exact telemetry available depends on the Industrial OS image and the surrounding OT platform. Preserve configuration exports, system and application logs, network records, EDR or process telemetry where supported, engineering workstation logs and remote-access session history. Keep software exposure and evidence of compromise as separate findings: an affected device is not proof of intrusion, while a corrected version does not prove the earlier exposure window was clean.

Validate the fix without executing a malicious flow

Do not create a command-executing Node-RED flow on a production device to prove the vulnerability is gone. Version, active-runtime, authentication and network-control evidence provide safer and more reproducible closure criteria.

Rollback planning for industrial environments

Before maintenance, export approved Node-RED projects and device configuration, document dependencies, confirm a recovery image and identify the operational owner who can approve rollback. A rollback must not silently restore an exposed vulnerable state. If operational compatibility requires temporary rollback, reapply the containment controls, document the risk acceptance and schedule the corrected deployment.

סיכום

CVE-2026-58115 is a direct unauthenticated path into a programming interface that can execute commands with maximum privileges. Identify the exact SIMATIC IOT2050 model and running version, map every route to Node-RED, restrict access, upgrade to V4.3.4.1 or later, remove Node-RED when unnecessary, and investigate exposed devices before closing the case. The strongest closure record combines corrected runtime state, authenticated administration, minimal network reachability and preserved evidence.

The following video introduces the general Penligent workflow. It is not a demonstration of this Siemens vulnerability.