--- schema: 1 kind: vulnerability title: "CVE-2026-58115 — Siemens SIMATIC IoT2050 Advanced ships a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code as root on an OT edge gateway (CVSS 10.0)" headline: "A Siemens industrial edge gateway exposes a flow-programming interface to anyone who can reach it, with maximum privileges and no credentials required" summary: > Siemens ProductCERT advisory SSA-834709 of 2026-08-11 discloses CVE-2026-58115, rated 10.0 on both CVSS 3.1 and 4.0: SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, which exposes programming nodes capable of running system commands. An unauthenticated attacker with network reach creates a flow and executes arbitrary code on the device with maximum privileges — no credentials, no user interaction, no prior foothold. All versions below V4.3.4.1 are affected; V4.3.4.1 is the fix, and Siemens offers uninstalling or hardening Node-RED as interim mitigations. No exploitation is reported. discovered_at: "2026-08-13T05:00:00Z" event_date: "2026-08-11" run_id: 2026-08-13T0412Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, pre-auth, ot-ics, default-config, patch-available] regions: [global, europe] sectors: [energy, water, transport, manufacturing] entities: [] techniques: [T1190, T1059] affected_products: ["Siemens SIMATIC IoT2050 Advanced"] cves: - id: CVE-2026-58115 cvss: "10.0" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available] affected: "SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions < V4.3.4.1 running Industrial OS with Node-RED installed" fixed: "V4.3.4.1" sources: - url: "https://cert-portal.siemens.com/productcert/html/ssa-834709.html" publisher: "Siemens ProductCERT" date: "2026-08-11" role: primary - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1009/" publisher: "ANSSI / CERT-FR" date: "2026-08-12" role: corroborating - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0282" publisher: "NCSC-NL" date: "2026-08-11" role: corroborating closed_sources: [] evidence: - quote: "Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server." publisher: "Siemens ProductCERT" - quote: "This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges." publisher: "Siemens ProductCERT" verification: multi-source sourcing_note: > Siemens ProductCERT is the primary as the vendor advisory for its own product; the CVE identifier, scores, affected range and fixed version are transcribed from that advisory rather than from the monthly roundup relaying it. CERT-FR and NCSC-NL carried the same August Siemens release to their constituencies and are corroborating publishers of the vendor's assessment rather than independent assessors of the flaw, which is why credibility is 2 rather than 1. confidence: high update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Inventory SIMATIC IoT2050 Advanced units for the Node-RED package and update to V4.3.4.1; where the update cannot be scheduled immediately, uninstall Node-RED on units that do not use it — Siemens names both uninstalling and hardening the Node-RED installation as its interim mitigations." migrated_from: null --- Siemens ProductCERT published SSA-834709 on 2026-08-11 covering CVE-2026-58115 in SIMATIC IoT2050 Advanced devices (order number 6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed. The advisory's own description of the defect is a single sentence with no qualifiers: "Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server." The consequence follows directly — "This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges." ([Siemens ProductCERT, 2026-08-11](https://cert-portal.siemens.com/productcert/html/ssa-834709.html)) Siemens scores it 10.0 under both CVSS 3.1 and CVSS 4.0, with the 3.1 vector recording network attack vector, low complexity, no privileges, no user interaction, changed scope and high impact on confidentiality, integrity and availability, classified as CWE-306, missing authentication for a critical function. All versions below V4.3.4.1 are affected; V4.3.4.1 is the remediation. Where the update cannot be applied, Siemens names two specific mitigations — uninstall Node-RED, or harden the Node-RED installation per its User Guide — alongside its standing recommendation to protect network access to devices and operate them inside a protected environment. ([Siemens ProductCERT, 2026-08-11](https://cert-portal.siemens.com/productcert/html/ssa-834709.html)) ANSSI's CERT-FR carried the advisory to its constituency on 12 August ([CERT-FR, 2026-08-12](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1009/)), and NCSC-NL published its own on 11 August ([NCSC-NL, 2026-08-11](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0282)). **Why this clears the bar without any exploitation report.** Nothing in the advisory claims in-the-wild abuse, and none is reported anywhere this run could find. The urgency comes from the flaw's own mechanics rather than from attacker activity: the vulnerable interface is a flow editor whose legitimate purpose is to run code, the missing control is authentication rather than a memory-safety condition needing a working exploit, and the SIMATIC IoT2050 is an edge gateway whose product role is to sit at the boundary between an operational network and the systems above it. There is no exploit to write — reaching the interface is the exploit — which is why the absence of observed activity says very little about how long that will remain true. That places it squarely in the class of flaws demanding an out-of-band response rather than the next maintenance cycle, and the affected device class is one European energy, water and transport operators deploy. **Detection and hardening, in telemetry terms.** The behaviour to look for is a change to the device's automation logic that no engineering workflow accounts for. In application and web-access telemetry on the gateway, requests to the Node-RED administrative and flow-deployment endpoints that arrive without an associated authenticated engineering-workstation session are the exploitation signal; in configuration state, flow definitions whose modification timestamps do not line up with a change record are the persistence signal; and in process and network telemetry on the device, command execution or outbound connections originating from the Node-RED runtime process — rather than from the automation application it is meant to serve — indicate the programming nodes are being used as an execution primitive. Because the interface answers anyone who can route to it, network position is the compensating control that works today: restrict reachability of the Node-RED HTTP interface to the engineering segment, and treat any path to it from a general-purpose corporate network or from a cellular or carrier-provided link as an exposure to remove rather than to monitor. **Defender takeaway:** the question to answer this week is not whether these devices are patched but whether they are *reachable*, and from where. A single unauthenticated request to a device with maximum privileges leaves no useful window between exposure and full compromise, and the interim mitigation Siemens offers — removing Node-RED entirely where it is not used — is available immediately and is the stronger control for any unit that never needed the flow editor in the first place.