CVE-2026-58115

This device has a built-in programming tool called Node-RED that lets people build automation workflows. Normally you'd need to log in to use it, but on affected devices anyone who can reach it over the network can use it without any password — like a factory control panel with no lock on the door, letting a stranger walk in and rewire the machine.

This matters to you if you operate a SIMATIC IoT2050 Advanced device with the Industrial OS and Node-RED component installed. The risk is highest if that device's Node-RED interface is reachable from the internet or from any untrusted part of your network, since no login is required to exploit it.

There are no confirmed reports of attackers exploiting this yet and no public exploit code is available, but the flaw allows complete, unauthenticated takeover of the device, so it still needs prompt attention. Given the severity and the sustained press attention around it, treat this as a priority to fix soon rather than an emergency to drop everything for.

Confirm exposure by inventorying all SIMATIC IoT2050 Advanced units and checking whether the Node-RED component is installed and whether its HTTP interface is reachable from any network beyond a trusted management segment. Target fixed version V4.3.4.1 or later per Siemens' advisory (support.industry.siemens.com/cs/ww/en/view/109741799/); there is no indication of breaking changes tied to this specific fix, but validate existing Node-RED flows after updating. As a temporary workaround until patching, isolate the device's Node-RED HTTP interface behind a firewall or VPN so it is not reachable from untrusted networks, and disable or restrict the interface if not actively needed. This CVE is not currently in CISA's KEV catalog, so there is no mandated remediation deadline, but monitor Siemens advisories and threat intelligence feeds for any change in exploitation status, and watch for unexpected Node-RED flow changes or command execution on the device as an indicator of compromise.

CVSS 3.1 score 10.0 (Critical), AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — remotely exploitable over the network with no privileges or user interaction, and full impact to confidentiality, integrity and availability with scope change. Weakness is CWE-306 (Missing Authentication for Critical Function) on the Node-RED HTTP interface, enabling creation of malicious flows that execute arbitrary system commands with maximum privileges. EPSS predicts low near-term exploitation likelihood (flat trend), and the CVE is not listed in CISA KEV; no public exploit code or confirmed in-the-wild activity has been identified, placing exploit maturity at theoretical/PoC-absent stage despite the critical severity.