CVE-2026-58115 — Siemens SIMATIC IoT2050 Advanced ships a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code as root on an OT edge gateway (CVSS 10.0)

Siemens ProductCERT published SSA-834709 on 2026-08-11 covering CVE-2026-58115 in SIMATIC IoT2050 Advanced devices (order number 6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed. The advisory's own description of the defect is a single sentence with no qualifiers: "Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server." The consequence follows directly — "This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges." (Siemens ProductCERT, 2026-08-11)

Siemens scores it 10.0 under both CVSS 3.1 and CVSS 4.0, with the 3.1 vector recording network attack vector, low complexity, no privileges, no user interaction, changed scope and high impact on confidentiality, integrity and availability, classified as CWE-306, missing authentication for a critical function. All versions below V4.3.4.1 are affected; V4.3.4.1 is the remediation. Where the update cannot be applied, Siemens names two specific mitigations — uninstall Node-RED, or harden the Node-RED installation per its User Guide — alongside its standing recommendation to protect network access to devices and operate them inside a protected environment. (Siemens ProductCERT, 2026-08-11) ANSSI's CERT-FR carried the advisory to its constituency on 12 August (CERT-FR, 2026-08-12), and NCSC-NL published its own on 11 August (NCSC-NL, 2026-08-11).

Why this clears the bar without any exploitation report. Nothing in the advisory claims in-the-wild abuse, and none is reported anywhere this run could find. The urgency comes from the flaw's own mechanics rather than from attacker activity: the vulnerable interface is a flow editor whose legitimate purpose is to run code, the missing control is authentication rather than a memory-safety condition needing a working exploit, and the SIMATIC IoT2050 is an edge gateway whose product role is to sit at the boundary between an operational network and the systems above it. There is no exploit to write — reaching the interface is the exploit — which is why the absence of observed activity says very little about how long that will remain true. That places it squarely in the class of flaws demanding an out-of-band response rather than the next maintenance cycle, and the affected device class is one European energy, water and transport operators deploy.

Detection and hardening, in telemetry terms. The behaviour to look for is a change to the device's automation logic that no engineering workflow accounts for. In application and web-access telemetry on the gateway, requests to the Node-RED administrative and flow-deployment endpoints that arrive without an associated authenticated engineering-workstation session are the exploitation signal; in configuration state, flow definitions whose modification timestamps do not line up with a change record are the persistence signal; and in process and network telemetry on the device, command execution or outbound connections originating from the Node-RED runtime process — rather than from the automation application it is meant to serve — indicate the programming nodes are being used as an execution primitive. Because the interface answers anyone who can route to it, network position is the compensating control that works today: restrict reachability of the Node-RED HTTP interface to the engineering segment, and treat any path to it from a general-purpose corporate network or from a cellular or carrier-provided link as an exposure to remove rather than to monitor.