CVE-2026-58115: Critical severity Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) vulnerability
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58115?
The severity of CVE-2026-58115 is rated as critical with a score of 10.
How do I fix CVE-2026-58115?
To mitigate CVE-2026-58115, upgrade the SIMATIC IoT2050 Advanced device to version 4.3.4.1 or later.
What type of vulnerability is CVE-2026-58115?
CVE-2026-58115 is a vulnerability that allows unauthenticated access to the Node-RED HTTP interface.
Which devices are affected by CVE-2026-58115?
CVE-2026-58115 affects all versions of Siemens SIMATIC IoT2050 Advanced prior to version 4.3.4.1 running Industrial OS with Node-RED installed.
What are the potential impacts of CVE-2026-58115?
The potential impacts of CVE-2026-58115 include unauthorized access to sensitive programming nodes, leading to possible manipulation of the device.