Summary
CVE-2026-58115 is a critical missing-authentication vulnerability (CWE-306) affecting the Node-RED HTTP interface bundled with Siemens SIMATIC IoT2050 Advanced devices running the Industrial OS. The Node-RED editor/admin API is exposed without any access control, allowing an unauthenticated network attacker to deploy malicious flows and execute arbitrary code with the highest privileges on the underlying server. The flaw carries the maximum CVSS v3.1 and v4.0 scores of 10.0.
Technical details
- Root cause: The Node-RED HTTP interface on affected devices ships without authentication enabled, leaving the editor and admin API reachable to anyone who can reach the device over the network.
- Trigger conditions: No credentials, prior access, or user interaction are required; the attacker only needs network access to the exposed HTTP interface.
- Attack vector: Network (remote, unauthenticated).
- Impact: An attacker can create and deploy malicious Node-RED flows containing function nodes that execute system commands, resulting in arbitrary code execution with maximum privileges (full compromise of confidentiality, integrity, and availability).
Affected software
- SIMATIC IoT2050 Advanced (Model 6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed: all versions prior to V4.3.4.1.
Severity
- CVSS v3.1 Base Score: 10.0 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v4.0 score is also 10.0.
Mitigation and recommended actions
- Immediate: Update the affected device to Industrial OS version V4.3.4.1 or later, which resolves the issue.
- If patching is not immediately possible:
- Uninstall Node-RED from the device if it is not required.
- Apply Node-RED’s official security hardening guidance to enable authentication on the editor/admin HTTP interface.
- Restrict network access to the device (e.g., segment it off untrusted networks, limit exposure via firewall rules) and follow Siemens’ general operational security recommendations for industrial devices.

