What happened
On August 11, 2026, Siemens published security advisory SSA-834709 about vulnerability CVE-2026-58115 in the SIMATIC IoT2050 Advanced industrial computer. It affects devices running Industrial OS that have Node-RED installed, a popular tool for building automation flows by dragging and connecting blocks in a web browser.
According to Siemens, the Node-RED web interface on these devices does not require a login. Anyone who can reach it over the network can create their own flow and use it to run arbitrary code on the device with the highest privileges. Siemens has released a fixed version, V4.3.4.1.
On November 3, 2026, The Hacker News reported that security firm VulnCheck has been observing attempts to exploit the flaw against its honeypots since October 30, 2026, with attackers trying to install a Linux botnet program. The flaw is not yet listed in the CISA KEV catalog, and the European vulnerability database EUVD does not list active exploitation. The Siemens advisory was last updated on August 11, 2026, and does not mention attacks.
Why it is dangerous
This is a “missing authentication for critical function” flaw (CWE-306). Picture a machine control panel standing next to an open door onto the street, with no lock and no password. Node-RED is exactly that kind of panel: you can build a flow in it that runs system commands. If nothing protects it, anyone can use it.
- The attack works over the network. If the Node-RED interface is reachable from the internet, the attacker can be anywhere.
- The attacker needs no login and no help from a user.
- According to Siemens, the code runs with maximum privileges, which means full control of the device.
- An attacker can read and alter data the device collects or sends, install malware, and use the device as a stepping stone into other parts of the network, including production systems.
Siemens rated the flaw CVSS 10.0 out of 10, the highest possible score, under both CVSS 3.1 and the newer CVSS 4.0. CVSS is an international severity scale that rates how easy a flaw is to exploit and how much damage it can cause.
The CISA KEV catalog lists flaws whose exploitation the U.S. agency CISA has confirmed. This flaw is not in it at the time of writing, but that does not make it harmless, since VulnCheck has already recorded attack attempts.
EPSS estimates the probability that a flaw will be exploited in the next 30 days. As of November 2, 2026, it is about 0.95%, higher than roughly 61% of known flaws. The number may not yet reflect the latest reports of attacks.
Who is affected
According to Siemens, the affected product is SIMATIC IoT2050 Advanced with order number 6ES7647-0BA00-1YA2, all versions before V4.3.4.1 that run Industrial OS and have Node-RED installed.
The IoT2050 is a small industrial computer that typically acts as a gateway between machines and IT. It collects data from PLCs and sensors on the shop floor, forwards it to the cloud or business systems, and is also used in building automation and IoT pilot projects. Node-RED is a common choice on it for quickly wiring up such connections. The highest risk is for devices whose Node-RED interface (port 1880 by default) is reachable from the internet or from a large, poorly segmented company network.
If Node-RED is not installed on the device, this flaw does not apply to it according to the Siemens description. The advisory only lists the Advanced model with the order number above and says nothing about other IoT2050 models.
How to check if you are affected
Start by listing where you have IoT2050 devices. They are often installed by an integrator or equipment supplier and may not appear in your regular IT inventory. The commands below only read information and change nothing.
Log in to the device, for example over SSH, to find the system version. Compare it with V4.3.4.1. If it is not shown here, check the deployment documentation or ask your supplier.
cat /etc/os-releaseCheck whether Node-RED is installed, running and listening on the network:
systemctl status node-red --no-pagerss -tlnp | grep 1880From another computer, check whether the interface requires a login. A 401 response means login is enabled, a 200 response means anyone can see the flows. Adjust the port if you use a different one. Only test your own devices.
curl -s -o /dev/null -w "%{http_code}\n" http://DEVICE_IP:1880/flowsHow to fix it
Siemens recommends updating to V4.3.4.1 or later. You can find it on the Siemens support page: https://support.industry.siemens.com/cs/ww/en/view/109741799/
Recommended order of steps:
- Restrict access right away. The Node-RED interface must not be reachable from the internet. Allow port 1880 on the firewall only from admin workstations or over VPN. Siemens generally recommends protecting network access to its devices.
- Before changing anything, check for signs of compromise (see the next section) and back up your flows and logs.
- Install V4.3.4.1 or later following the Siemens instructions. Back up your configuration first.
- When restoring flows from a backup, make sure they contain no unfamiliar nodes, or you could reinstall a backdoor yourself.
- If you do not need Node-RED, uninstall it. If you do, keep it secured after the update too.
If you cannot update right away, Siemens lists two temporary measures: uninstall Node-RED, or harden the installation following the Node-RED user guide. The Hacker News summarizes these steps from it:
- enable HTTPS access
- protect the editor and admin API with credentials or through an OAuth or OpenID provider
- protect the HTTP nodes and the Node-RED Dashboard with basic authentication
What if you may already be compromised
If the Node-RED interface was reachable from the internet, assume someone may have tried it. According to VulnCheck, as reported by The Hacker News, attackers deploy a new flow that downloads and runs a Linux botnet program. Other attempts created a persistent backdoor inside Node-RED itself that survives a reboot.
- unknown flows in the Node-RED editor, especially “http in”, “function” and “exec” nodes wired together with a path like
/cmdor a random name - the files
/dev/shm/.b,/tmp/.kworkeror a script namedwget.sh - connections to 85.215.73[.]250 or 45.194.90[.]57 (port 38472) in firewall or proxy logs
wgetorcurlcommands in flows, and processes started from/dev/shmor/tmpthat you do not recognize
These commands only read:
ls -la /dev/shm/ /tmp/ps -eo pid,user,args | grep -E "[/]dev/shm|[/]tmp/"find / -path "*node-red*" -name "flows*.json" 2>/dev/nullgrep -nE '"exec"|wget|curl' /path/to/flows.jsonThe next command shows when Node-RED started flows, for example after changes were deployed. A deployment at a time when nobody on your team was working on the flows is suspicious.
journalctl -u node-red --no-pager | grep -iE "start(ing|ed) (modified )?flows"If you find anything, disconnect the device from the network, but do not power it off or delete anything. Bring in an industrial security specialist, because the attacker had full privileges and may have moved further into the network. Then reinstall the device from a clean V4.3.4.1 or later image and change all passwords and credentials stored in the flows.