A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED… (CVE-2026-58115)
A critical vulnerability exists in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, affecting all versions prior to V4.3.4.1. The issue arises because the Node-RED HTTP interface does not enforce authentication, allowing unauthenticated remote attackers to access programming nodes. This access enables attackers to create malicious flows that execute arbitrary system commands with maximum privileges on the underlying server.
AI Analysis
Technical Summary
CVE-2026-58115 is a critical vulnerability in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices running Industrial OS with Node-RED installed, specifically all versions before V4.3.4.1. The vulnerability stems from the lack of authentication enforcement on the Node-RED HTTP interface, which allows unauthenticated remote attackers to access programming nodes capable of executing system commands. Exploiting this flaw enables attackers to execute arbitrary code on the server with maximum privileges, potentially compromising confidentiality, integrity, and availability of the device.
Potential Impact
An unauthenticated remote attacker can gain full control over the affected device by executing arbitrary system commands with maximum privileges. This can lead to complete compromise of the device, including data theft, system manipulation, and denial of service.
Mitigation Recommendations
No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the Node-RED HTTP interface to trusted users only and consider disabling Node-RED if not required.
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED… (CVE-2026-58115)
Description
A critical vulnerability exists in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, affecting all versions prior to V4.3.4.1. The issue arises because the Node-RED HTTP interface does not enforce authentication, allowing unauthenticated remote attackers to access programming nodes. This access enables attackers to create malicious flows that execute arbitrary system commands with maximum privileges on the underlying server.
CVSS v3.1
Score 10.0critical
Affected software
pkg:github/siemens/SIMATIC-IoT2050-AdvancedRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58115 is a critical vulnerability in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices running Industrial OS with Node-RED installed, specifically all versions before V4.3.4.1. The vulnerability stems from the lack of authentication enforcement on the Node-RED HTTP interface, which allows unauthenticated remote attackers to access programming nodes capable of executing system commands. Exploiting this flaw enables attackers to execute arbitrary code on the server with maximum privileges, potentially compromising confidentiality, integrity, and availability of the device.
Potential Impact
An unauthenticated remote attacker can gain full control over the affected device by executing arbitrary system commands with maximum privileges. This can lead to complete compromise of the device, including data theft, system manipulation, and denial of service.
Mitigation Recommendations
No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the Node-RED HTTP interface to trusted users only and consider disabling Node-RED if not required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mmh6-f99q-64fh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58115"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a7b6fcfbf8831d5393ea096
Added to database: 08/11/2026, 18:54:07 UTC
Last enriched: 08/11/2026, 19:11:33 UTC
Last updated: 08/12/2026, 02:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.