Attackers Exploit Siemens IoT2050 Node-RED Vulnerability

TL;DR - Siemens says SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are affected by CVE-2026-58115. - The flaw permits unauthenticated access to the Node-RED HTTP interface and can enable arbitrary code execution with maximum privileges. - Siemens lists CVSS v3.1 and CVSS v4.0 base scores of 10.0. - VulnCheck reports exploitation involving malicious flows, downloaded Linux payloads, and command backdoors. - Siemens recommends updating to V4.3.4.1 or later, uninstalling Node-RED, or hardening the installation.

What happened#

Siemens published security advisory SSA-834709 on 2026-08-11 for a missing authentication vulnerability in Node-RED on SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. The affected product is listed as SIMATIC IoT2050 Advanced, product number 6ES7647-0BA00-1YA2, with all versions < V4.3.4.1 affected. Siemens identifies the issue as CVE-2026-58115.

According to Siemens, affected devices do not enforce authentication on the Node-RED HTTP interface. That allows unauthenticated access to programming nodes capable of executing system commands on the server. Siemens says an unauthenticated remote attacker could create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

The Siemens advisory assigns CVSS v3.1 and CVSS v4.0 base scores of 10.0. It classifies the issue as CWE-306, Missing Authentication for Critical Function.

VulnCheck reports that on October 30, 2026, one of its canaries received a complete exploit for the vulnerability. The reported activity deployed a Node-RED flow, triggered it automatically, and downloaded and ran a Linux bot. VulnCheck said it observed 16 events from the same IP against this CVE between October 30 and November 1.

The researcher also reported flows that exposed HTTP endpoints connected to Node-RED exec nodes. Those flows could allow later command execution through query parameters, according to VulnCheck. The exact functionality of some downloaded files was not determined because the files were not retrieved. VulnCheck describes the observed exploitation and payloads.

Are you affected#

You may be affected if your organization uses a SIMATIC IoT2050 Advanced, product number 6ES7647-0BA00-1YA2, running Industrial OS with Node-RED installed, and the device is running a version earlier than V4.3.4.1.

Siemens lists the remediation as updating to V4.3.4.1 or a later version. The advisory does not identify other SIMATIC IoT2050 product variants as affected.

The available information does not establish how many devices have been compromised or whether any particular organization was affected. VulnCheck’s observations were made against its canary network, and the researcher did not retrieve or analyze some of the reported payloads.

What is confirmed and what is reported#

What defenders should do now#

1. Identify SIMATIC IoT2050 Advanced devices, product number 6ES7647-0BA00-1YA2, running Industrial OS with Node-RED installed.

2. Check whether affected devices are running a version earlier than V4.3.4.1. Siemens recommends updating to V4.3.4.1 or a later version. The remediation link provided by Siemens is the SIMATIC IoT2050 support page.

3. Where updating is not immediately possible, consider Siemens’ listed mitigations: uninstall Node-RED or harden the Node-RED installation by following the Node-RED User Guide.

4. Review Node-RED flows, revisions, HTTP endpoints, function nodes, and exec nodes for unauthorized changes. This review is relevant to the flow-based activity described by VulnCheck, including flows that could expose command execution through an HTTP endpoint.

5. Examine device and network telemetry for unexpected downloads, processes, or connections associated with the indicators described by VulnCheck. The researcher reported payload references involving 85.215.73[.]250:8080 and 45.194.90[.]57:38472, while noting that some payloads were not retrieved or analyzed.

6. Restrict network access to affected devices. Siemens recommends protecting network access with appropriate mechanisms and configuring the environment according to its operational guidelines for Industrial Security.

7. Follow Siemens’ general security recommendations and the product manuals while reviewing the device’s security configuration. Siemens provides additional Industrial Security information.

8. If investigation identifies unauthorized flows, processes, or network activity, preserve relevant logs and device data for incident response. The available advisories do not provide a specific forensic procedure or confirm the capabilities of every reported payload.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: cert-portal.siemens.com
• Research: vulncheck.com
• Report: thehackernews.com