MAG212 CYBER ORIGINAL ARTICLE

Siemens SIMATIC IoT2050 Node-RED Flaw CVE-2026-58115 Now Covers Four Models: Update to V4.3.4-1

November 5, 2026 · El Mostafa Ouchen

Siemens has widened its advisory for a maximum-severity flaw in SIMATIC IoT2050 industrial gateways. When it was first published in August, advisory SSA-834709 covered one model. The November 4, 2026 revision now names four: the IoT2050 Advanced, Basic, M.2 and SM. The flaw, CVE-2026-58115, scores 10.0. On affected devices that run Siemens Industrial OS with Node-RED installed, the Node-RED web interface accepts changes without any login, so anyone who can reach it can run commands on the device with full privileges.

The timing matters. Days before the revision, the vulnerability-intelligence firm VulnCheck reported live exploit attempts against a Node-RED decoy it runs. And CISA’s copy of the advisory, which many operators rely on, still lists only the original model.

How we label claims: Confirmed = stated by the vendor, a CVE record or a government agency; Reported = stated by a named researcher or news outlet; MAG212 analysis = our assessment; Unknown = no source we checked has said. Updated November 5, 2026. By El Mostafa Ouchen.

Key facts

Item	Detail	Status
Advisory	Siemens ProductCERT SSA-834709, “Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 with Industrial OS”; V1.0 August 11, 2026; V1.1 November 4, 2026	Confirmed (Siemens)
What changed	V1.1 clarified the affected products list and updated the title and summary; scope grew from one model to four	Confirmed (Siemens)
CVE	CVE-2026-58115, CWE-306 (missing authentication for a critical function)	Confirmed
Severity	CVSS 3.1 10.0 and CVSS 4.0 10.0	Confirmed (Siemens)
Affected	IoT2050 Advanced, Basic, M.2 and SM, all versions below V4.3.4-1, running Industrial OS with Node-RED installed	Confirmed (Siemens)
Fix	Update to V4.3.4-1 or later	Confirmed (Siemens)
Exploitation	VulnCheck saw an exploit attempt against a Node-RED canary on October 30; no confirmed production victim; not in CISA KEV	Reported (VulnCheck); KEV status Confirmed
CISA advisory	ICSA-26-237-03 (August 25) still lists only the Advanced model as of November 5	Confirmed (CISA CSAF data)

Affected devices

Model	Article number	Affected versions
SIMATIC IoT2050 Advanced	6ES7647-0BA00-1YA2	Below V4.3.4-1, with Node-RED installed
SIMATIC IoT2050 Basic	6ES7647-0BA00-0YA2	Below V4.3.4-1, with Node-RED installed
SIMATIC IoT2050 M.2	6ES7647-0BB00-1YA2	Below V4.3.4-1, with Node-RED installed
SIMATIC IoT2050 SM	6ES7647-0CA00-1AA2	Below V4.3.4-1, with Node-RED installed

The SIMATIC IoT2050 is a compact gateway at the low end of Siemens’ industrial PC range, often used to collect machine data and pass it to other systems. CISA lists the critical manufacturing, chemical, energy and transportation sectors as using the product. Siemens writes the fixed version as V4.3.4-1, while CISA and some databases write 4.3.4.1. They refer to the same release.

What the flaw is

Node-RED is a popular low-code tool for wiring together devices and data flows through a browser-based editor. Its documentation is blunt: out of the box, the editor isn’t secured, and anyone who can reach its address can use it. Securing it means turning on the adminAuth setting.

Siemens says the affected devices don’t enforce authentication on the Node-RED HTTP interface. That gives an unauthenticated attacker access to Node-RED’s programming nodes, some of which run system commands. An attacker can create a malicious flow and execute code on the device with maximum privileges. Siemens describes this as a problem in how Node-RED is set up on the device, not a bug in Node-RED’s own code. Status: Confirmed (Siemens).

What VulnCheck saw

VulnCheck published detection artifacts for the flaw on October 27. On October 30 one of its canary systems, a decoy built to attract attacks, received a complete exploit attempt. The attacker sent a request to Node-RED’s /flows endpoint that created a flow with an inject node, set to fire once, wired to an exec (command-execution) node. The command decoded a script that downloaded a Linux bot program, saved it as /dev/shm/.b and launched it. Between October 30 and November 1, the same source address produced 16 attempts against this flaw. Later variants dropped files in /tmp/.s and /tmp/.kworker, or planted a simple web shell through an HTTP-input node.

VulnCheck didn’t retrieve the bot program, so its capabilities are unknown, and it doesn’t claim any real victims. It added the flaw to its own exploited-vulnerabilities list. CISA’s KEV catalog does not list it as of its November 4 version. Status: Reported (VulnCheck); KEV Confirmed (CISA KEV data).

MAG212 analysis: the request VulnCheck captured is generic Node-RED abuse. It would work against any Node-RED instance without authentication, not only Siemens devices. If you run Node-RED anywhere, on a gateway, a Raspberry Pi or a server, the same check applies.

Why the CISA gap matters

CISA republished Siemens’ advisory in August as ICSA-26-237-03, titled for the IoT2050 Advanced only. As of November 5, CISA’s published data still showed that single model. Operators who track ICS advisories through CISA alone, or whose asset tools match on CISA’s product list, may not realize that their Basic, M.2 or SM gateways are affected. MAG212 analysis: for Siemens equipment, treat Siemens ProductCERT as the authoritative source and check it directly.

What to do, in order

Find every IoT2050 of all four models, and check whether Node-RED is installed and running on each.
Cut network access to the Node-RED interface from anything but trusted engineering hosts, and make sure no IoT2050 is reachable from the internet.
Update to Industrial OS V4.3.4-1 or later, Siemens’ fix for all four models.
If you can’t update yet, Siemens offers two options: uninstall Node-RED, or harden the installation following the Node-RED user guide.
Harden Node-RED wherever it runs: enable adminAuth with bcrypt-hashed passwords and the minimum permissions each user needs, turn on HTTPS, and protect HTTP endpoints exposed by flows with httpNodeAuth.
Check for tampering: review deployed flows for command-execution nodes you didn’t create, and look for the files VulnCheck reported.

CISA’s general ICS advice applies as well: minimize network exposure of control devices, keep control networks behind firewalls and separate from business networks, use secure and up-to-date remote access, and assess the impact before deploying defensive changes on production systems.

How to check a Node-RED instance

Node-RED’s admin API reports whether login is required. This read-only request, from an engineering workstation that can reach the device (Linux, macOS or Windows with curl; no special privileges; replace the address and port; not tested by MAG212), returns an empty object {} when no authentication is active:

curl -s --max-time 5 http://192.0.2.20:1880/auth/login

A response listing a "type":"credentials" login prompt means authentication is configured. 1880 is Node-RED’s usual port, but installations may differ. Adjust the scheme or path if HTTPS or a custom admin path (httpAdminRoot) is configured. Don’t run write requests against production devices.

What to look for

HTTP POST requests to /flows from hosts other than your engineers’ workstations.
Flows containing “exec” nodes, or “http in” nodes wired to “exec” nodes, that nobody on your team created.
Files such as /dev/shm/.b, /tmp/.s or /tmp/.kworker on the device.
Unexpected outbound downloads from the gateway, especially with wget or curl.

Legitimate automation sometimes uses exec nodes, so compare against your documented flows before escalating.

Frequently asked questions

Is CVE-2026-58115 being exploited?

VulnCheck caught an exploit attempt against a decoy on October 30 and repeated attempts afterward. No real victim has been reported, and the flaw is not in CISA’s KEV catalog.

My IoT2050 doesn’t run Node-RED. Am I affected?

Siemens says devices are affected only when Node-RED is installed. Confirm it isn’t present, and update anyway.

Why does CISA list only one model?

CISA republished Siemens’ original August advisory and, as of November 5, had not updated it for Siemens’ November 4 revision. Use Siemens’ advisory.

Read today’s full MAG212 CYBER Daily (free) →

Subscribe free