CVE-2026-58115 Siemens CVE debrief

Who should care

Organizations using SIMATIC IoT2050 Advanced devices with Node-RED installed, Industrial Control Systems administrators, and cybersecurity teams responsible for ICS security should prioritize patching and compensating controls due to the critical CVSS score of 10 and potential for unauthenticated remote code execution. These teams should verify affected scope, implement authentication and authorization for Node-RED, and monitor for suspicious activity.

Technical summary

The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the underlying server with maximum privileges by creating malicious flows through the Node-RED HTTP interface. Affected devices are SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) with Node-RED installed, running Industrial OS versions before V4.3.4.1. Organizations should verify affected scope, implement authentication and authorization for Node-RED, restrict access to programming nodes, and monitor for suspicious activity to mitigate potential impacts. Evidence from official CVE Program record and NIST NVD detail page confirms the vulnerability in SIMATIC IoT2050 Advanced devices, but limited information is available on affected scope and vendor remediation efforts.

Defensive priority

High priority due to critical CVSS score of 10 and potential for unauthenticated remote code execution.

Recommended defensive actions

• Inventory and verify SIMATIC IoT2050 Advanced devices for Node-RED installation and version checks
• Implement authentication and authorization for Node-RED HTTP interface
• Restrict access to programming nodes and monitor for suspicious activity
• Apply vendor-provided patches or updates when available
• Consider compensating controls such as network segmentation and intrusion detection

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page confirms the vulnerability in SIMATIC IoT2050 Advanced devices. Limited information available on affected scope and vendor remediation efforts. Defenders should verify Node-RED installation, check for authentication enforcement, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.