CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM ship a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation
Node-RED flaw in Siemens IoT2050 hit a VulnCheck canary; V4.3.4-1 fixes Industrial OS, Example Image has no fix
Defender actions
- Update every SIMATIC IoT2050 running Industrial OS (Advanced, Basic, M.2 and SM) to V4.3.4-1 or later now; on units running Example Image versions, for which Siemens has no fix, and wherever the update cannot happen at once, uninstall Node-RED if it is unused or harden it as Siemens' Node-RED User Guide describes and take its HTTP interface off networks that untrusted hosts can reach, since exploitation takes a single unauthenticated request.
- On every Node-RED instance that was reachable from an untrusted network, review the deployed flows for exec nodes and http-in endpoints that nobody built, and the access logs for POST requests to /flows from non-engineering addresses.
Analysis
Siemens ProductCERT published SSA-834709 on 2026-08-11 for CVE-2026-58115 in SIMATIC IoT2050 devices with Node-RED installed (the current advisory, V1.2 of 2026-11-10, lists the Advanced, Basic, M.2 and SM variants running Industrial OS or Example Image versions): affected devices "do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server", so an unauthenticated remote attacker can create malicious flows and run code with maximum privileges. Siemens scores it 10.0 under CVSS 3.1 and 4.0 (CWE-306), names V4.3.4-1 as the fix for earlier Industrial OS versions and no fix for Example Image versions, and offers uninstalling Node-RED or hardening it per its User Guide as interim mitigations (Siemens ProductCERT, 2026-08-11). CERT-FR and NCSC-NL carried the advisory in August and list only the Advanced variant (CERT-FR, 2026-08-12; NCSC-NL, 2026-08-11).
VulnCheck reports that on 2026-10-30 one of its canaries caught an attacker exploiting CVE-2026-58115 with a single POST to the Node-RED /flows endpoint: an inject node wired to an exec node ran a base64-wrapped shell command that downloaded a Linux bot into the RAM-backed /dev/shm as a hidden file and started it detached (VulnCheck, 2026-11-01). By 2026-11-01 the same address had produced 16 events against this CVE with further payloads, among them flows that expose an http-in endpoint wired to an exec node as a persistent web shell; VulnCheck did not retrieve the bot, so its function is unknown, and it reads the address as opportunistic mass-scanning infrastructure rather than a campaign (VulnCheck, 2026-11-01). The target was a canary, not a Siemens device, and CISA's catalog did not list the flaw as VulnCheck wrote (VulnCheck, 2026-11-01); The Register relays the finding (The Register, 2026-11-02).
Triage: legitimate engineering deployments also POST to /flows; the signal is a deployment from a non-engineering address whose exec node carries encoded shell or a download-and-execute chain (an inference from the described mechanism).
Cited evidence
Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.
This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
Clarified Affected products list. Updated title. Updated summary.
Added additional affected configuration for SIMATIC IoT2050 family
On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot.
This backdoor survives even if a memory-backed implant is lost on reboot.
it is not in CISA's KEV at the time of writing
Updates3
VulnCheck says one of its canaries caught an attacker exploiting CVE-2026-58115 on 2026-10-30 with a single POST to the Node-RED /flows endpoint that deployed a flow downloading and running a Linux bot, and that the same address produced 16 events against this CVE by 2026-11-01, some deploying persistent http-in web-shell flows; it did not retrieve the bot and reads the traffic as opportunistic mass scanning (VulnCheck, 2026-11-01). The target was a canary, not a Siemens device, and CISA's catalog did not list the flaw when VulnCheck wrote (VulnCheck, 2026-11-01); The Register relays the finding (The Register, 2026-11-02).
Siemens revised SSA-834709 to V1.1 on 2026-11-04, describing the change as "Clarified Affected products list. Updated title. Updated summary." (Siemens ProductCERT, 2026-08-11). The current advisory lists SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Basic (6ES7647-0BA00-0YA2), M.2 (6ES7647-0BB00-1YA2) and SM (6ES7647-0CA00-1AA2), each in all versions below V4.3.4-1 running Industrial OS with Node-RED installed, with "Update to V4.3.4-1 or later version" as the fix (Siemens ProductCERT, 2026-08-11). Owners of the Basic, M.2 and SM variants are therefore in scope for the update and for the exposure and detection points above; the 10.0 scores and the two interim mitigations are unchanged.
Siemens revised SSA-834709 to V1.2 on 2026-11-10, describing the change as "Added additional affected configuration for SIMATIC IoT2050 family" (Siemens ProductCERT, 2026-08-11). For each of the four variants the advisory now lists a second affected configuration, "All versions running Example Image versions with Node-RED installed", for which "Currently no fix is available"; the fix, update to V4.3.4-1 or later, applies only to the Industrial OS configurations, and the two mitigations, hardening Node-RED and uninstalling it, apply to all eight (Siemens ProductCERT, 2026-08-11). The advisory's title and summary still say "with Industrial OS", Siemens does not define Example Image, and the advisory makes no statement on exploitation; VulnCheck remains the only exploitation source (VulnCheck, 2026-11-01).
Sources5
Revision history
- Published 2026-08-13T0412Z-intel
- Update 2026-11-03T0256Z-intel
VulnCheck reports that on 2026-10-30 one of its canaries caught an attacker exploiting CVE-2026-58115 with a single unauthenticated request that deployed a flow downloading and running a Linux bot, with web-shell flows from the same address since; no Siemens device is reported compromised.
Changed: title headline summary tags techniques cves sources evidence sourcing_note actions body
- Update 2026-11-07T0256Z-intel
Siemens revised its advisory SSA-834709 to V1.1 on 2026-11-04 and now lists the SIMATIC IoT2050 Advanced, Basic, M.2 and SM variants as affected, all versions below V4.3.4-1 with Node-RED installed; the fix and interim mitigations are unchanged, so owners of the three further variants are in scope as well.
Changed: title headline summary affected_products cves evidence actions body entities
- Update 2026-11-12T0255Z-intel
Siemens revised SSA-834709 to V1.2 on 2026-11-10 and added a second affected configuration for each of the four IoT2050 variants, all versions running Example Image versions with Node-RED installed, for which no fix is available; the V4.3.4-1 fix and the interim mitigations apply only as stated for Industrial OS and Node-RED.
Changed: headline summary cves evidence actions body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.