Siemens IoT2050 Node-RED Flaw CVE-2026-58115 Exploited

Attackers are exploiting the Siemens IoT2050 Node-RED flaw CVE-2026-58115, a CVSS 10.0 missing authentication bug that lets anyone who can reach the Node-RED HTTP interface on a SIMATIC IoT2050 Advanced deploy flows that run system commands with maximum privileges. VulnCheck caught the first in-the-wild attempt on October 30, 2026. Siemens shipped the fix (device version V4.3.4.1) on August 11. If you run IoT2050 Advanced units with Node-RED, update them or uninstall Node-RED today, then check every deployed flow for commands you did not write.

What happened

Siemens ProductCERT published advisory SSA-834709 on August 11, 2026. It covers one vulnerability, CVE-2026-58115, in SIMATIC IoT2050 Advanced devices (order number 6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed. The devices do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated remote user can reach the programming nodes that execute commands on the underlying system.

The bug sat quietly for two and a half months. On October 27, VulnCheck published a detection for it. Three days later, on October 30, one of VulnCheck's canary systems recorded a successful exploitation attempt. Between October 30 and November 1 the same source IP sent 16 exploitation events against the flaw, and VulnCheck added CVE-2026-58115 to its own KEV list. VulnCheck published its write-up on November 2.

CISA has not added the CVE to its Known Exploited Vulnerabilities catalog. The current KEV feed (catalog version 2026.10.30) does not list it.

Who is affected

The Siemens advisory lists one product: SIMATIC IoT2050 Advanced, all versions before V4.3.4.1, when running Industrial OS with Node-RED installed. Units without Node-RED are not listed as affected.

The exposure is wider than one Siemens gateway. VulnCheck says the traffic it saw goes after any Node-RED instance without adminAuth configured, found and exploited automatically. Nothing in the requests was specific to Siemens hardware. Node-RED ships with its editor open by default; the project's own security guide says plainly that the editor is not secured out of the box. Any Node-RED install on a factory gateway, a building controller, a Raspberry Pi in a lab or a cloud VM is in scope if its editor answers on the network without a login. For background on the tool itself, see what Node-RED is and why an open editor is a risk.

VulnCheck also notes that Emerson documentation mentions Node-RED, but it has not confirmed whether any Emerson products are affected.

How the Siemens IoT2050 Node-RED flaw works

CVE-2026-58115 is classed as CWE-306, missing authentication for a critical function. Siemens scores it 10.0 under both CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0. The critical function here is the Node-RED admin API: the interface the browser editor uses to save and deploy flows. Node-RED includes nodes that run operating system commands by design, so whoever can deploy a flow can run commands as the Node-RED process. On the IoT2050 that means maximum privileges, per Siemens.

VulnCheck's capture shows what the attacker did with that access, at a level defenders can use:

A single request to the admin API's flow deployment endpoint replaced the running flows and triggered a downloader automatically.
The downloader fetched a Linux binary and stored it in a RAM-backed path (/dev/shm/.b), so a reboot would clear it. VulnCheck did not obtain or analyze the binary.
Later variants pulled a staged script, fetched a second payload from a different server saved as /tmp/.kworker, and in some cases planted HTTP endpoints wired to command execution nodes. Those endpoints live in the flow configuration, so they survive a reboot.
The same source IP hit VulnCheck's canaries 125 times across several products, including Apache Solr (CVE-2019-17558), Gitea, MLflow, Traefik and Joomla. This is opportunistic scanning, not a targeted ICS campaign.

What to do now

Patch the gateways. Update SIMATIC IoT2050 Advanced units to V4.3.4.1 or later. Siemens links the download from the advisory (Siemens Industry Online Support entry 109741799).
If you cannot update yet, remove or lock down Node-RED. Siemens lists two mitigations: uninstall Node-RED, or harden it following the Node-RED security guide. Our walkthrough on how to secure Node-RED with adminAuth and HTTPS covers the settings involved.
Cut network reach. Siemens recommends protecting network access to the devices. The Node-RED editor should never answer from the internet, and on the plant network it should be reachable only from the engineering workstations that need it.
Hunt for compromise before you call it done. Patching closes the door but does not remove a flow an attacker already deployed. Export the current flows on every Node-RED instance and look for command execution nodes or HTTP input endpoints you did not create. Check /dev/shm and /tmp for hidden files such as .b, .s and .kworker.
Search logs for the indicators VulnCheck published. Source IP 4.201.105.116; payload servers 85.215.73.250 (port 8080) and 45.194.90.57 (port 38472). Look for unexpected writes to the flow deployment endpoint in any reverse proxy or firewall logs in front of Node-RED.
Rebuild if you find anything. A gateway that ran an unknown botnet binary as root should be reimaged from a known good image, not cleaned in place. Rotate any credentials stored in its flows (MQTT, database, cloud API keys).

What to watch next

Watch for CISA to add CVE-2026-58115 to KEV; VulnCheck's catalog already lists it. Siemens may also revise SSA-834709 if it confirms exploitation on customer devices. The longer question is ownership: small industrial gateways like the IoT2050 often fall between IT and OT teams, which is how a CVSS 10.0 fix from August is still worth exploiting in November. We cover that gap in why industrial IoT gateways need a named patch owner. For a similar case of an orchestration tool that executes whatever definition it receives, see our coverage of Orkes Conductor CVE-2026-58138.