Full Report
SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. Siemens has released a new version for SIMATIC IoT2050 Advanced and strongly recommends to update to the latest version.
Analysis Summary
# Vulnerability: Missing Authentication in Node-RED on SIMATIC IoT2050 Advanced
## CVE Details
- **CVE ID:** CVE-2026-58115
- **CVSS Score:** 10.0 (Critical)
- **CVSS Vector:**
- v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
- v4.0: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- **CWE:** CWE-306 (Missing Authentication for Critical Function)
## Affected Systems
- **Products:** SIMATIC IoT2050 Advanced (MLFB: 6ES7647-0BA00-1YA2)
- **Versions:** All versions prior to V4.3.4.1
- **Configurations:** Systems running **Industrial OS** with **Node-RED** installed.
## Vulnerability Description
The vulnerability exists because the Node-RED HTTP interface on the affected devices does not enforce authentication. Node-RED includes programming nodes designed to execute system-level commands. Because the interface is exposed without credentials, an attacker can access the runtime environment and deploy "flows" (logic sequences) containing malicious code. This results in Remote Code Execution (RCE) on the underlying Linux operating system with maximum privileges.
## Exploitation
- **Status:** Not specified as exploited in the wild; no public PoC mentioned in the advisory.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to system data and files)
- **Integrity:** High (Ability to modify system configurations and logic)
- **Availability:** High (Ability to crash the system or disrupt industrial processes)
## Remediation
### Patches
Siemens strongly recommends updating to the following version:
- **SIMATIC IoT2050 Advanced:** Update to **V4.3.4.1** or later.
- **Download Link:** hxxps://support.industry.siemens.com/cs/ww/en/view/109741799/
### Workarounds
If patching is not immediately possible, implement the following mitigations:
- **Uninstall Node-RED:** Remove the software if it is not required for operations.
- **Manual Hardening:** Follow the official Node-RED security guide to enable authentication manually (hxxps://nodered.org/docs/user-guide/runtime/securing-node-red).
- **Network Isolation:** Ensure the device is not accessible from untrusted networks or the internet.
## Detection
- **Indicators of Compromise:** Review Node-RED logs for unauthorized flow deployments or access from unknown IP addresses. Check system processes for unexpected scripts or shells originating from the Node-RED service user.
- **Detection Methods:** Audit the device to check if the Node-RED web interface (typically port 1880) prompts for credentials.
## References
- **Siemens Security Advisory (SSA-834709):** hxxps://cert-portal.siemens.com/productcert/html/ssa-834709.html
- **Siemens Industrial Security Guidelines:** hxxps://www.siemens.com/cert/operational-guidelines-industrial-security
- **Contact:** hxxps://www.siemens.com/cert/advisories