---
title: A CVSS 10 Node-RED flaw in Siemens SIMATIC IoT2050 devices (CVE-2026-58115) is being exploited: attackers deploy flows that drop Linux bots or leave /cmd webshells | ctxsec
url: https://ctxsec.com/items/siemens-iot2050-node-red-cve-2026-58115-exploited-vulncheck
description: "Siemens disclosed CVE-2026-58115 in August: SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed don't enforce authentication on the Node-RED HTTP interface, so anyone who can reach it can create flows that run commands with maximum privileges. VulnCheck says its canaries caught complete exploits from Oct 30: a single POST /flows that deploys an inject node wired to an exec node, which downloads and runs a Linux bot from /dev/shm. By Nov 1 the same source had sent 16 attempts, including flows that expose a persistent HTTP webshell. Siemens' fix is IoT2050 Advanced V4.3.4.1 or later."
status: "official (Siemens SSA-834709, Aug 11; VulnCheck in-the-wild canary data, Nov 2). Not in CISA KEV as of this run; VulnCheck added it to its own KEV"
published: 2026-11-03
---

> Siemens disclosed CVE-2026-58115 in August: SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed don't enforce authentication on the Node-RED HTTP interface, so anyone who can reach it can create flows that run commands with maximum privileges. VulnCheck says its canaries caught complete exploits from Oct 30: a single POST /flows that deploys an inject node wired to an exec node, which downloads and runs a Linux bot from /dev/shm. By Nov 1 the same source had sent 16 attempts, including flows that expose a persistent HTTP webshell. Siemens' fix is IoT2050 Advanced V4.3.4.1 or later.

[← Cybersecurity News](/news) · [markdown](/items/siemens-iot2050-node-red-cve-2026-58115-exploited-vulncheck.md)

official (Siemens SSA-834709, Aug 11; VulnCheck in-the-wild canary data, Nov 2). Not in CISA KEV as of this run; VulnCheck added it to its own KEV

2026-11-03

### A CVSS 10 Node-RED flaw in Siemens SIMATIC IoT2050 devices (CVE-2026-58115) is being exploited: attackers deploy flows that drop Linux bots or leave /cmd webshells

- **Affected (Siemens):** SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions before V4.3.4.1 running Industrial OS with Node-RED installed. CVSS 3.1 and 4.0 both 10.0.
- **Fix and mitigations (Siemens):** update to V4.3.4.1 or later; otherwise uninstall Node-RED or harden it per the Node-RED user guide (credential or OAuth/OpenID auth on the editor and admin API, HTTPS, auth on HTTP nodes and the dashboard).
- **Exploitation (VulnCheck):** first seen Oct 30 from 4.201.105.116 (Microsoft AS8075), which VulnCheck reads as opportunistic, likely rented infrastructure that also hit Solr, Camunda, Gitea, MLflow, Traefik and Joomla. VulnCheck did not analyze the bot binary and makes no claim about what it does.
- **Wider exposure:** the underlying problem is any Node-RED instance without `adminAuth` reachable from the network, not just Siemens hardware. VulnCheck notes Node-RED also ships in other OT products but has not checked whether they are affected.

**What to do:** make sure no Node-RED editor or admin API is reachable from outside the network, turn on `adminAuth` everywhere, update IoT2050 Advanced units, and review deployed flows for unexpected `exec` nodes or `http in` endpoints. See the companion hunt for indicators.

Sources: [Siemens ProductCERT: SSA-834709 (CVE-2026-58115)](https://cert-portal.siemens.com/productcert/html/ssa-834709.html) · [VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products (Nov 2)](https://www.vulncheck.com/blog/exploitation-targeting-node-red) · [SecurityWeek: Critical Node-RED flaw exploited in attacks](https://www.securityweek.com/critical-node-red-flaw-exploited-in-attacks/)