CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Siemens SIMATIC IoT2050 Basic

product · product:siemens-simatic-iot2050-basic

Coverage
1
first 2026-08-13 → last 2026-11-07
Latest activity
2026-11-07
VulnCheck caught exploitation of the Node-RED flaw in Siemens IoT2050; all four variants affected, V4.3.4-1…
Peak priority
high
1 high
Targets
energy
sectors: energy, water, transport · regions: europe
Sources cited
5
5 hosts

Action items (2)

Do-now tasks recorded on the entries about Siemens SIMATIC IoT2050 Basic, newest first. Check the date before acting on an older one.

  • Update every SIMATIC IoT2050 (Advanced, Basic, M.2 and SM) to V4.3.4-1 or later now; where that cannot happen at once, uninstall Node-RED on units that do not use it, since Siemens names uninstalling or hardening Node-RED as its interim mitigations and exploitation takes a single unauthenticated request.
    2026-08-13CVE-2026-58115
  • On every Node-RED instance that was reachable from an untrusted network, review the deployed flows for exec nodes and http-in endpoints that nobody built, and the access logs for POST requests to /flows from non-engineering addresses.
    2026-08-13CVE-2026-58115

Defender insights

What each entry about Siemens SIMATIC IoT2050 Basic tells a defender to do, newest first.

2026-08-13HIGHexploitedVulnCheck caught exploitation of the Node-RED flaw in Siemens IoT2050; all four variants affected, V4.3.4-1 fixes

Exposure · triage · detection

Story timeline

  1. 2026-08-13CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM ship a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation
    trending-vulnerabilitiesVulnCheck caught exploitation of the Node-RED flaw in Siemens IoT2050; all four variants affected, V4.3.4-1 fixes

Hunting pivots

CVEs (exploited first)
CVE-2026-58115
Releases covered
Siemens SIMATIC IoT2050 Basic
Tags
actively-exploiteddefault-configot-icspatch-availablepre-authrcevulnerabilities
ATT&CK techniques (6 across 5 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter · Command and Scripting Interpreter: Unix Shell
  • PersistenceServer Software Component: Web Shell
  • StealthObfuscated Files or Information
  • Command and ControlIngress Tool Transfer

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root · ATT&CK page ↗

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root · ATT&CK page ↗

Entries about Siemens SIMATIC IoT2050 Basic (1)

2026-08-13 · view entry permalink →

HIGHCVE-2026-58115exploitedupdatedNATOA2

CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM ship a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation

Siemens ProductCERT published SSA-834709 on 2026-08-11 for CVE-2026-58115 in SIMATIC IoT2050 devices running Industrial OS with Node-RED installed (the current advisory, V1.1 of 2026-11-04, lists the Advanced, Basic, M.2 and SM variants): affected devices "do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server", so an unauthenticated remote attacker can create malicious flows and run code with maximum privileges. Siemens scores it 10.0 under CVSS 3.1 and 4.0 (CWE-306), names V4.3.4-1 as the fix for every earlier version, and offers uninstalling Node-RED or hardening it per its User Guide as interim mitigations (Siemens ProductCERT, 2026-08-11). CERT-FR and NCSC-NL carried the advisory in August and list only the Advanced variant (CERT-FR, 2026-08-12; NCSC-NL, 2026-08-11).

VulnCheck reports that on 2026-10-30 one of its canaries caught an attacker exploiting CVE-2026-58115 with a single POST to the Node-RED /flows endpoint: an inject node wired to an exec node ran a base64-wrapped shell command that downloaded a Linux bot into the RAM-backed /dev/shm as a hidden file and started it detached (VulnCheck, 2026-11-01). By 2026-11-01 the same address had produced 16 events against this CVE with further payloads, among them flows that expose an http-in endpoint wired to an exec node as a persistent web shell; VulnCheck did not retrieve the bot, so its function is unknown, and it reads the address as opportunistic mass-scanning infrastructure rather than a campaign (VulnCheck, 2026-11-01). The target was a canary, not a Siemens device, and CISA's catalog did not list the flaw as VulnCheck wrote (VulnCheck, 2026-11-01); The Register relays the finding (The Register, 2026-11-02).

Triage: legitimate engineering deployments also POST to /flows; the signal is a deployment from a non-engineering address whose exec node carries encoded shell or a download-and-execute chain (an inference from the described mechanism).

Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.

This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

Clarified Affected products list. Updated title. Updated summary.

Siemens ProductCERT 2026-08-11

On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot.

This backdoor survives even if a memory-backed implant is lost on reboot.

it is not in CISA's KEV at the time of writing

VulnCheck 2026-11-01
Updaterun 2026-11-03T0256Z-inteltitleheadlinesummarytagstechniquescvessourcesevidencesourcing_noteactionsbody

VulnCheck says one of its canaries caught an attacker exploiting CVE-2026-58115 on 2026-10-30 with a single POST to the Node-RED /flows endpoint that deployed a flow downloading and running a Linux bot, and that the same address produced 16 events against this CVE by 2026-11-01, some deploying persistent http-in web-shell flows; it did not retrieve the bot and reads the traffic as opportunistic mass scanning (VulnCheck, 2026-11-01). The target was a canary, not a Siemens device, and CISA's catalog did not list the flaw when VulnCheck wrote (VulnCheck, 2026-11-01); The Register relays the finding (The Register, 2026-11-02).

Updaterun 2026-11-07T0256Z-inteltitleheadlinesummaryaffected_productscvesevidenceactionsbodyentities

Siemens revised SSA-834709 to V1.1 on 2026-11-04, describing the change as "Clarified Affected products list. Updated title. Updated summary." (Siemens ProductCERT, 2026-08-11). The current advisory lists SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Basic (6ES7647-0BA00-0YA2), M.2 (6ES7647-0BB00-1YA2) and SM (6ES7647-0CA00-1AA2), each in all versions below V4.3.4-1 running Industrial OS with Node-RED installed, with "Update to V4.3.4-1 or later version" as the fix (Siemens ProductCERT, 2026-08-11). Owners of the Basic, M.2 and SM variants are therefore in scope for the update and for the exposure and detection points above; the 10.0 scores and the two interim mitigations are unchanged.

vulnerability13 Aug 05:00Zmulti-sourceOpen finding →
Sources: Siemens ProductCERT · ANSSI / CERT-FR · NCSC-NL · VulnCheck · The Register

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • advisories.ncsc.nl1 (20%)
  • cert-portal.siemens.com1 (20%)
  • cert.ssi.gouv.fr1 (20%)
  • theregister.com1 (20%)
  • vulncheck.com1 (20%)
All cited sources (5)