Short answer: A critical security flaw in Siemens IoT2050 devices allows attackers to run code remotely. Users should update to version 4.3.4.1 or remove Node-RED.
TL;DR
- Siemens IoT2050 devices have a missing authentication vulnerability.
- Attackers can use this to run arbitrary code.
- Update to version 4.3.4.1 or remove Node-RED.
- Follow Siemens' security guidelines.
What is CVE-2026-58115?
This issue is a missing authentication problem in Siemens IoT2050 Advanced devices. If not fixed, attackers can gain full control over the device by exploiting a flaw in the Node-RED HTTP interface. This could allow them to run harmful code and create backdoors. Siemens recommends updating the software or uninstalling Node-RED to secure the device.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Malware
- Harmful software made to spy, steal or damage.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 03 Nov 2026 |
| CVE | CVE-2026-58115 |
| CVSS | 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-306 (missing authentication) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Affected product | Siemens IoT2050 |
| Published in NVD | 2026-08-11 (CVE-2026-58115) |
How it works
The attack targets the Node-RED HTTP interface in Siemens SIMATIC IoT2050 Advanced devices. It lacks authentication, allowing attackers to create malicious flows that can execute harmful code.
- Attacker reaches the Siemens IoT2050 over the internet / network
- No login or account is needed
- Sends crafted input that triggers the missing authentication flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-08-11 | CVE-2026-58115 published in NVD | NVD |
| 2026-11-03 | Reported by The Hacker News | The Hacker News |
| 2026-11-03 | This Skillmate explainer published | Skillmate |
How to fix it
- Update Siemens IoT2050 to the fixed release named in the vendor advisory.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Look for unexpected logins, unusual Node-RED flows, and commands running on the server.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-58115 is a real NVD record scored 10.0 CRITICAL | CISA KEV does not list CVE-2026-58115 as exploited in the wild |
| Reported by The Hacker News | NVD links no vendor advisory for CVE-2026-58115 yet |
| Reported by cert-portal.siemens.com |
Why it matters
This flaw poses a significant risk as it can be exploited by unauthenticated attackers. Companies and users must update to version 4.3.4.1 or apply mitigations to prevent remote command execution and protect critical systems.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is Node-RED?
Node-RED is a visual programming tool that allows users to create flows for IoT devices, connecting and controlling them.
How can attackers exploit this flaw?
Attackers can use unauthenticated access to create malicious flows that run arbitrary code on the server.
What version fixes the flaw?
Version 4.3.4.1 or later of the Industrial OS with Node-RED installed fixes the flaw.
What should I do if I find a suspicious flow?
Uninstall Node-RED or harden the installation by securing the HTTP interface and implementing authentication.
Related Skillmate posts
Sources
- Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors (The Hacker News)
- Siemens (primary source) (cert-portal.siemens.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
