Siemens IoT2050 Vulnerability CVE-2026-58115: Unauthenticated Node-RED Flaw Under Attack, Update to V4.3.4.1

Siemens has fixed a maximum-severity flaw, CVE-2026-58115, in the SIMATIC IoT2050 Advanced, a compact industrial computer that often sits between factory equipment and the office network. Researchers at VulnCheck say attackers started exploiting the weakness on October 30, 2026. If you have an IoT2050 running Node-RED that can be reached from another network, update it to V4.3.4.1 or lock it down this week.

What happened with the Siemens IoT2050 vulnerability

Siemens ProductCERT published advisory SSA-834709 on Tuesday, August 11, 2026. It describes CVE-2026-58115 as missing authentication for a critical function (CWE-306) in Node-RED, a visual programming tool that can be installed on the IoT2050 Advanced with Industrial OS. Siemens says the Node-RED HTTP interface on affected devices does not enforce authentication. That gives anyone who can reach it access to programming nodes that run system commands. Through that interface a remote attacker can create malicious flows and run any code with maximum privileges.

Siemens rates it 10.0 under both CVSS 3.1 and CVSS 4.0, the highest score possible. The advisory is still at version 1.0 with no later revisions.

The advisory was out for weeks before attacks began. VulnCheck researcher Patrick Garrity reported that the company's canaries (decoy systems built to attract attackers) caught a successful exploit on Friday, October 30, 2026, and saw more activity through November 1.

What is confirmed and what is not known

Confirmed by Siemens:

• Affected: SIMATIC IoT2050 Advanced (order number 6ES7647-0BA00-1YA2), all versions before V4.3.4.1 running Industrial OS with Node-RED installed.
• Fixed: V4.3.4.1 or later.
• Workarounds: uninstall Node-RED, or harden it using the Node-RED security guide, and restrict network access to the device.

Confirmed by VulnCheck:

• Attackers sent exploit requests to VulnCheck's canaries, and the canaries recorded successful flow deployments.
• VulnCheck added CVE-2026-58115 to its own exploited-vulnerabilities catalog. When VulnCheck wrote its report, the flaw was not on CISA's Known Exploited Vulnerabilities list.

Not known:

• Whether real IoT2050 devices at companies have been compromised. The confirmed hits were on decoy systems.
• What the downloaded malware does. VulnCheck did not retrieve or analyze the binary and makes no claims about it.
• How many devices are exposed. No count has been published.
• Whether other vendors' products are affected. VulnCheck notes that Emerson documentation mentions Node-RED but says it did not check whether Emerson products are vulnerable.

How the Node-RED attacks work

VulnCheck describes one web request to the Node-RED /flows endpoint that deploys a new flow with an inject node and an exec node. The flow runs as soon as it is deployed. Its command, hidden under three layers of base64 encoding, downloads a program, saves it as /dev/shm/.b and starts it in the background.

Later variants changed the method:

• One downloaded a script called wget.sh and ran it from /tmp/.s.
• Another fetched a second program from a server on port 38472 and saved it as /tmp/.kworker, a name that looks like a normal Linux system process.
• Some requests downloaded nothing. They added an HTTP endpoint, such as /cmd or a random path, wired to an exec node. That is a webshell: the attacker can come back later and run commands just by visiting a web address.

A rogue flow is saved in Node-RED's own configuration, not just held in memory. So do not count on a reboot to clean up a device.

The attack source VulnCheck tracked, 4.201.105.116, sent 125 requests against 8 different vulnerabilities, including flaws in Apache Solr, Gitea and MLflow. VulnCheck calls this opportunistic mass scanning: automated tools hitting whatever answers, not a targeted campaign against one company.

Why this matters beyond Siemens

The CVE belongs to Siemens, but the weakness behind it is broader. Node-RED's own documentation says the editor is not secured by default: anyone who can reach its address can open it and deploy changes. VulnCheck says Node-RED instances without adminAuth (the login setting) are being found and exploited automatically.

That makes this a business problem, not only a factory problem. Node-RED shows up on gateways, Raspberry Pi boards, virtual machines and dashboards built by a contractor years ago. Many of these boxes connect machines to the office network, store passwords for databases or cloud services, and are rarely patched. If an attacker gets into one, they have a foothold inside your network, and on an industrial gateway they may also be able to reach the equipment it talks to. If you run Node-RED on your own servers, treat it like any other self-hosted service: it needs an owner, a login and a firewall.

How to fix CVE-2026-58115: checklist for this week

How to secure Node-RED with adminAuth

The Node-RED security guide covers three settings in the settings file:

• adminAuth: uncomment it and add a user with a bcrypt password hash. On Node-RED 1.1.0 and later, node-red admin hash-pw generates the hash. Give full access ("*") only to the people who edit flows, and "read" to anyone else.
• https: set a private key and certificate so logins are not sent in plain text.
• httpNodeAuth: puts a username and password on the endpoints created by HTTP In nodes, the same kind of endpoint attackers used for webshells.

Restart Node-RED after making changes and make sure the editor asks for a login before you move on.

Siemens IoT2050 vulnerability questions people are asking

Is CVE-2026-58115 being exploited?

Yes. VulnCheck recorded successful exploitation against its decoy systems starting October 30, 2026. It has not been confirmed on real company devices, and when VulnCheck wrote its report the flaw was not on CISA's KEV list.

Which Siemens devices are affected?

The SIMATIC IoT2050 Advanced, order number 6ES7647-0BA00-1YA2, on any version before V4.3.4.1 that runs Industrial OS with Node-RED installed.

What is the fixed version?

V4.3.4.1 or later, according to Siemens advisory SSA-834709.

Is there a workaround if I cannot patch?

Siemens lists two: uninstall Node-RED, or harden it using the Node-RED security guide. Siemens also recommends restricting network access to the device.

Does this affect Node-RED outside Siemens hardware?

The CVE applies only to the Siemens device, but the same attack works on any Node-RED editor that has no login. Node-RED's documentation says the editor is unsecured by default, so check every install you have.

How do I know if my device was hacked?

Look for the files /dev/shm/.b, /tmp/.s or /tmp/.kworker, flows you did not create that contain exec nodes or HTTP endpoints like /cmd, and traffic to or from the IP addresses in the checklist above.

The bigger lesson

This attack needed no clever trick. It used a tool that does exactly what it was built to do, on a device nobody had told it to protect. Convenient defaults were meant for trusted networks, then the network around them changed. Automated scanners do not care whether a box is a factory gateway or a test machine under a desk: if it answers without a password, they will use it. Knowing what you run, requiring a login on everything, and keeping industrial devices behind a firewall would have stopped every step VulnCheck described.

For help finding and locking down devices like this, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Siemens ProductCERT SSA-834709; VulnCheck: Exploitation Targeting Node-RED; Node-RED: Securing Node-RED.