Siemens SIMATIC IoT2050 Advanced: 1 CVE, Critical 10.0
Summary
CISA reports 1 vulnerability in Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2). Weakness type: Missing Authentication for Critical Function. SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum… Highest CVSS v3 score: 10.0 (Critical), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)
- CVEs
- CVE-2026-58115
- Highest CVSS v3
- 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Chemical, Critical Manufacturing, Energy, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-58115 | Missing Authentication for Critical Function | 10.0 | – | No | CVE-2026-58115 |
Affected products (1)
- SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) < V4.3.4.1 running Industrial OS with Node-RED installed
Vendor fixes and mitigations (from advisory)
- Mitigation: Harden the Node-RED installation (see Node-RED User Guide)
- Mitigation: Uninstall Node-RED
- Vendor Fix: Update to V4.3.4.1 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-237-03
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-834709.json
- https://cert-portal.siemens.com/productcert/html/ssa-834709.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.