Affected product(s):
| Product | Affected versions | Fixed version |
| SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) | Prior to V4.3.4.1 with Node-RED installed | V4.3.4.1 |
Devices without Node-RED installed are not affected.
Description
A critical severity vulnerability (CVSSv4 10.0 – CRITICAL) has been published in Node-RED on Siemens SIMATIC IoT2050 Advanced, allowing an unauthenticated remote attacker to execute arbitrary code with maximum privileges without user interaction. The vulnerability has been assigned CVE-2026-58115 and is of the missing authentication for critical function type (CWE-306). The vendor published the advisory on 11/08/2026 and also assigns it a CVSS v3.1 score of 10.0.
The flaw is located in Node-RED’s HTTP interface (editor and administration API, on the default port 1880), which does not require authentication. An attacker can create flows with nodes that execute system commands and thereby execute arbitrary code with maximum privileges.
Active exploitation of this vulnerability has been confirmed. Researchers recorded the first attack on a honeypot on 30/10/2026 and 16 events from the same IP address between 30/10/2026 and 01/11/2026, with several payloads. This is opportunistic mass scanning activity: the same IP address also attacked 8 other vulnerabilities in products such as Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla. The vulnerability is listed in third-party exploitation catalogs.
In the observed attacks, a single POST request to /flows deploys a tab containing an inject node (which runs once, on the second) and an exec node that decodes and executes a base64-encoded command. That command downloads a binary using wget or curl, grants it execute permissions, and launches it in the background. Variants that download a script or a second binary were also observed, as were persistent webshells created with an “http in” node (for example, /cmd) connected to function and exec nodes, which survive restarts. The downloaded binary was not analyzed, so its capabilities are unknown.
Mitigation
Until the update is applied, the vendor’s mitigations and the network measures described in the Solution section must be applied.
Detection/IoC
Indicators of compromise associated with the observed exploitation:
| Type | Indicator | Context |
| IP | 4.201.105[.]116 | Attack source (AS8075, Microsoft cloud, geolocated in Brazil) |
| IP | 85.215.73[.]250 | Payload server, port 8080 |
| URL | hxxp://85.215.73[.]250:8080/bot-linux-amd64 | Bot download |
| URL | hxxp://85.215.73[.]250:8080/wget.sh | Script variant |
| IP | 45.194.90[.]57 | Second payload server, port 38472 |
| URL | hxxp://45.194.90[.]57:38472/.sys_update | Second download (/tmp/.kworker) |
| File | /dev/shm/.b, /tmp/.s, /tmp/.kworker | Drop paths |
To check whether a device has been compromised, the following is recommended:
- Look for unknown flows with exec or function nodes, or unauthorized “http in” nodes.
- Look for hidden files in /dev/shm and /tmp.
- Review the processes launched by Node-RED.
- Look for connections to the IP addresses in the IoC table.
Solution
The solution consists of updating SIMATIC IoT2050 Advanced to version V4.3.4.1 or later, available at the following link:
https://support.industry.siemens.com/cs/ww/en/view/109741799/
As a mitigation, the vendor recommends uninstalling Node-RED if it is not used, or hardening the installation: enable adminAuth in settings.js, generate the password hash with node-red admin hash-pw, use HTTPS, and protect the HTTP nodes.
Additionally, it is recommended:
- Block external access to port 1880, segment the OT network, and do not expose the device to the Internet.
- Use a VPN when remote access is required.
Node-RED is integrated into other OT/IIoT products. Node-RED instances without adminAuth, from any vendor, are at risk from the same technique, although this does not imply that other products are affected by CVE-2026-58115.
For information on how to update, visit the following link:
https://cert-portal.siemens.com/productcert/html/ssa-834709.html
Additional information:
- Siemens — security advisory SSA-834709:
https://cert-portal.siemens.com/productcert/html/ssa-834709.html - CISA — ICS advisory ICSA-26-237-03:
https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03 - NVD — CVE-2026-58115:
https://nvd.nist.gov/vuln/detail/CVE-2026-58115 - VulnCheck — exploitation targeting Node-RED:
https://www.vulncheck.com/blog/exploitation-targeting-node-red - Node-RED — guide to securing Node-RED:
https://nodered.org/docs/user-guide/runtime/securing-node-red