CVE-2026-58115 is a missing authentication vulnerability (CWE-306) in Siemens SIMATIC IoT2050 Advanced devices (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, affecting all versions before 4.3.4.1. The Node-RED HTTP interface does not enforce authentication, permitting unauthenticated remote attackers to create malicious flows that execute arbitrary system commands with full privileges on the device. This vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by Siemens as of the data provided.

An unauthenticated remote attacker can gain full control over the affected device by executing arbitrary code with maximum privileges via the Node-RED HTTP interface. This compromises confidentiality, integrity, and availability of the system, potentially leading to full device takeover, disruption of industrial processes, and unauthorized access to sensitive data.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Node-RED HTTP interface to trusted networks only and monitor for unauthorized access attempts. Do not expose the interface to untrusted networks.