CVE-2026-58115: RCE on Node-RED SIMATIC IoT2050

CVE-2026-58115 is a critical vulnerability in SIMATIC IoT2050 Advanced (model 6ES7647-0BA00-1YA2) in versions prior to 4.3.4.1. The flaw affects the HTTP interface of Node-RED, which does not enforce authentication, allowing attackers to access it without credentials. Through this unprotected interface, it is possible to create malicious flows containing command execution nodes, enabling arbitrary code execution on the server with maximum privileges. The impact is complete: full compromise of the industrial gateway device.

The vulnerability has CVSS 10.0, the maximum score, and is declared critical by official sources. It was confirmed and registered in the National Vulnerability Database on August 11, 2026. Web signals show active interest: over the past 3 months, multiple discussion posts have appeared, with 5 mentions in the last 24 hours, suggesting that risk awareness is widespread in industrial environments and IT teams. No publicly available exploits have been reported on public repositories.

Defensive actions are urgent and cannot be delayed. Immediately verify the version of every SIMATIC IoT2050 in your organization and the Node-RED configuration. If version < 4.3.4.1 is present, proceed without delay to update to 4.3.4.1 or later, applying the official patch provided by Siemens. During the transition period, it is critical to monitor access to the Node-RED HTTP interface to detect exploitation attempts. Restrict access to the network from only necessary management systems.