CVE-2026-58115 · Siemens SIMATIC IoT2050 Node-RED missing authentication allows RCE

01 · The Real Story

A doorless Node-RED cockpit on an industrial gateway

SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed expose the Node-RED HTTP editor/API without any authentication. Any version before V4.3.4.1 is affected: an attacker who can reach the Node-RED port can POST flows containing exec nodes and execute operating-system commands as the Node-RED user, which Siemens states runs with maximum privileges.

Vendor severity CRITICAL 10.0 is justified. This is unauthenticated remote code execution on a device that often bridges IT and OT. Active exploitation reported by VulnCheck in November 2026 removes the 'lab-only' objection — attackers are already using it to plant remote command backdoors.

"Unauthenticated Node-RED on an OT gateway is a pre-auth root shell waiting to happen"

02 · The Attack Path

4 steps from start to impact.

STEP 01

Find an exposed Node-RED HTTP interface

Node-RED typically listens on TCP 1880 or a custom port. Attackers locate reachable SIMATIC IoT2050 devices using Shodan, Censys, FOFA, or internal network scanning. The interface is easily fingerprinted by its HTML/title or /flows endpoint.

Conditions required:

Network path to the Node-RED editor/API port
Node-RED installed and running on the IoT2050

Where this breaks in practice:

Many industrial gateways are behind firewalls, VPNs, or isolated OT cells
Node-RED is optional; devices without it are not affected

Detection/coverage: Shodan/Censys-indexed Node-RED instances can be identified by service banners or HTTP titles; internal scans can query /flows without auth.

STEP 02

Abuse the Node-RED /flows API without credentials

Because the flaw is missing authentication, the editor UI and REST API accept unauthenticated requests. No username, password, token, or session cookie is required to write flow definitions.

Conditions required:

Vulnerable Industrial OS version < V4.3.4.1
Node-RED HTTP interface reachable

Where this breaks in practice:

None once network reachability exists — this is a trivial step

Detection/coverage: HTTP access logs may show unexpected POST /flows from attacker IPs; default Node-RED has no alerting for flow modifications.

STEP 03

Deploy a malicious flow containing an exec node

The attacker sends a flow JSON body that includes a Node-RED exec node configured to run a reverse shell, backdoor, or arbitrary command. Node-RED accepts and deploys the flow immediately, executing the command on the underlying server.

Conditions required:

Attacker has network access to the Node-RED API
Knowledge of Node-RED flow JSON schema or use of public exploitation tooling

Where this breaks in practice:

Public flow templates and exploitation code are widely available
VulnCheck activity indicates in-the-wild tooling exists

Detection/coverage: Flow deployment changes may be visible in Node-RED logs if verbose logging is enabled; otherwise this is hard to distinguish from legitimate engineering.

STEP 04

Achieve unauthenticated command execution with maximum privileges

The deployed exec node runs commands as the Node-RED process user, which Siemens reports as maximum privileges/root. The attacker can install persistent backdoors, agent software, or pivot into connected PLC/SCADA segments.

Conditions required:

Node-RED service runs with sufficient privileges, as stated in advisory
Gateway has connectivity to industrial process network or IT network

Where this breaks in practice:

If Node-RED were run as a non-root user, blast radius would be lower — but Siemens advisory states maximum privileges

Detection/coverage: EDR/HIDS on the gateway may detect unexpected shell spawns or outbound C2, but many OT gateways lack deep endpoint monitoring.

03 · Compensating Control

CRITICAL 10.0→IGNORE 0.0

SEVERITY REDUCED

Apply Siemens update to V4.3.4.1 or latest — Upgrade SIMATIC IoT2050 Advanced to V4.3.4.1 or later immediately. This is the root fix and eliminates the missing-auth flaw. Because active exploitation is reported, treat this as a same-day/hours action, per the noisgate mitigation SLA override for active exploitation.

CRITICAL 10.0→IGNORE 0.0

SEVERITY REDUCED

Disable or uninstall Node-RED if not required — If the gateway does not need Node-RED, remove it. Devices without Node-RED are not affected. This is the safest pre-patch mitigation and should be completed within hours for any exposed or reachable device.

CRITICAL 10.0→HIGH 7.5

SEVERITY REDUCED

Restrict Node-RED HTTP interface to trusted management network/VPN or bind to loopback — If Node-RED must remain, immediately apply firewall rules, ACLs, or reverse proxy authentication so only authenticated administrators on a dedicated management VLAN can reach the editor/API. This blocks pure internet remote attackers but does not stop a host that is already on that trusted segment because the Node-RED API itself still has no auth.

What doesn't work

Changing Node-RED credentials or setting an admin password does not fix the vulnerability — there is no authentication check to satisfy.
WAF or signature-based filtering alone is not reliable: the exploit is an ordinary HTTP POST /flows request and can be disguised as legitimate flow management.
Endpoint AV/EDR on the gateway may catch the post-exploit shell but does not prevent initial flow deployment or command execution through the trusted Node-RED process.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	Active exploitation reported by VulnCheck via The Hacker News (Nov 2026) to plant remote command backdoors; not yet listed in CISA KEV as of prompt data.
Proof-of-concept availability	VulDB reported no public PoC at initial disclosure (Aug 10); later active exploitation implies private or commodity exploitation tooling.
EPSS score / percentile	0.00953 (0.953%) — very low raw EPSS, typical for newly disclosed ICS/OT CVEs and not a reliable signal once exploitation starts.
KEV status	Not listed in CISA KEV at the time of this assessment; active exploitation may trigger future inclusion.
CVSS vector / interpretation	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — network, low complexity, no privileges, no user interaction, changed scope, all impacts high.
Affected versions	SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions < V4.3.4.1 when Node-RED is installed.
Fixed versions	Update to V4.3.4.1 or later; or uninstall Node-RED if not required.
Exposure data	Node-RED default port 1880/TCP is commonly fingerprinted by Shodan/Censys; exact exposure count not in provided sources, but active exploitation implies reachable devices exist.
Disclosure date	2026-08-11 via Siemens advisory / INCIBE.
Reporting researcher/org	Siemens ProductCERT disclosed; no external researcher credited in initial advisory.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (10.0/10)

Why this verdict

No auth, no complexity: the entire attack is a reachable Node-RED HTTP API with missing authentication — no credential guessing, no memory corruption, no chain.
Active exploitation evidence: VulnCheck reported this flaw being used to plant remote command backdoors on exposed devices, removing 'theoretical' risk.
Role multiplier: SIMATIC IoT2050 devices routinely sit at the IT/OT boundary as industrial edge gateways; unauthenticated root-equivalent RCE there can pivot into PLC/SCADA segments, so the canonical deployment is a high-value role and floors the verdict at CRITICAL.
OT blast radius: command execution with maximum privileges on an industrial gateway can alter process data, disable controls, or move laterally into safety-related networks.

Why not higher?

Already at maximum severity 10.0 — there is no higher bucket. Devices without Node-RED are not affected, and fully isolated installations with no inbound access to the Node-RED interface are not reachable. But those conditions do not reduce the severity of a reachable affected device.

Why not lower?

Missing authentication leading directly to arbitrary command execution as root on an industrial IoT gateway cannot be downgraded. Active exploitation and the IT/OT pivot risk reinforce the CRITICAL baseline, even though Node-RED is optional and network segmentation may block some attacks.

06 · Verification

Crowdsourced verification payload.

Run this on the SIMATIC IoT2050 device via SSH or console, as root. Copy the script to the device and invoke sudo bash cve-2026-58115-check.sh. It checks Node-RED presence and Industrial OS version locally; no network access required.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash
# CVE-2026-58115 verification for Siemens SIMATIC IoT2050 Advanced
set -u

nodered_found=""
if command -v node-red >/dev/null 2>&1; then
  nodered_found=1
elif systemctl list-units --type=service --all 2>/dev/null | grep -q 'node-red'; then
  nodered_found=1
elif [ -d /usr/lib/node_modules/node-red ] || [ -d /opt/node-red ]; then
  nodered_found=1
fi

if [ -z "${nodered_found:-}" ]; then
  echo "PATCHED (Node-RED is not installed or not detected)"
  exit 0
fi

version=""
for f in /etc/siemens-version /etc/siemens-iot-version /etc/issue /etc/os-release; do
  if [ -r "$f" ]; then
    version=$(grep -Eo 'V?[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' "$f" 2>/dev/null | head -n1)
    [ -n "$version" ] && break
  fi
done

if [ -z "$version" ]; then
  echo "UNKNOWN (Node-RED present, but Industrial OS version could not be determined)"
  exit 2
fi

numver="${version#V}"
fixed="4.3.4.1"

if [ "$numver" = "$fixed" ]; then
  echo "PATCHED (version $version >= $fixed)"
  exit 0
fi

if [ "$(printf '%s\n%s\n' "$fixed" "$numver" | sort -V | head -n1)" = "$numver" ]; then
  echo "VULNERABLE (version $version < $fixed with Node-RED installed)"
  exit 1
else
  echo "PATCHED (version $version >= $fixed)"
  exit 0
fi