Siemens IoT2050: check Node-RED after an exploitation report
Canada reports exploitation of CVE-2026-58115. The NVD record identifies one Industrial OS model with Node-RED, before V4.3.4.1.
Going deeper
Generated image · SecuFocus
At a glance
Key points
If you maintain a SIMATIC IoT2050 Advanced running Industrial OS with Node-RED, check its version and who can reach the HTTP interface. In its 3 November update, the Canadian Centre for Cyber Security relays open-source reporting of exploitation of CVE-2026-58115. The NVD record describes an unauthenticated interface that allows commands to run with maximum privileges on versions before V4.3.4.1.
Identify the model, operating system and component
The NVD description names SIMATIC IoT2050 Advanced, part number 6ES7647-0BA00-1YA2, in versions before V4.3.4.1 running Industrial OS with Node-RED installed. Node-RED is a flow-based programming tool. In this configuration, its HTTP interface does not enforce authentication even though some programming nodes can execute system commands on the server.
According to the record, an unauthenticated remote attacker can create malicious flows and execute code on the underlying system with maximum privileges. Identify this device and configuration rather than assuming that every Siemens controller or product has the same vulnerability.
What Canada says about exploitation
Canadian advisory AV26-802 was first issued on 11 August. Its 3 November update says open-source reporting indicates exploitation of CVE-2026-58115 in the wild. That is the authority’s wording: we have not observed an attack on a device, and the advisory does not describe the campaign here.
The table also lists Desigo, Parasolid and other Siemens software. The exploitation statement concerns this specific CVE, not every row. Likewise, the older exploitation assessment retained in the NVD record does not supersede the more recent Canadian update.
Review access without disrupting the installation
Give the maintainer the device part number, installed version and whether Node-RED is present. V4.3.4.1 is the published boundary: an older version in the described configuration is affected. That alone does not identify the right update package and procedure for your installation.
On production equipment, do not run a demonstration flow, reboot at random or erase the configuration to see whether the warning disappears. Plan the update, backups and legitimate maintenance access. If suspicious exposure is found, an update alone does not establish that the device was never used by an attacker.
- Confirm the model, Industrial OS, Node-RED and the version actually installed.
- Have the HTTP interface’s access paths reviewed and unnecessary access limited without cutting off authorised maintenance.
- Arrange the correction and its verification with the installation owner, preserving evidence that could be useful in an investigation.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.