Skip to content
Sign in
CVE-2026-5811510.0CriticalCWE-306

CVE-2026-58115: Siemens SIMATIC IoT2050 Advanced vulnerability

Siemens · SIMATIC IoT2050 Advanced

Vendor fix available · Affected: Siemens SIMATIC IoT2050 Advanced · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub3 Nov
  5. Not established: not seen
0.9%probability of exploitation in the next 30 days
59th percentile
050100

Higher than 59% of scored CVEs

10.0CriticalCVSS 3.1
LowCrit.

DescriptionNVD

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

What changed

  1. PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub

Coverage5 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 12 Aug.

Full timeline
Quiet for 2 dayslast report 9 Nov5 articles3 outlets
12 Aug · SecurityOnline first29 Sep15 OctNow
  • Wed 12 Aug, 09:51 UTC. SecurityOnline, first report. Siemens warns of CVE-2026-58115 RCE in SIMATIC IoT2050 devices.
  • Tue 3 Nov, 01:30 UTC. SecurityOnline. Attackers exploit Node-RED flaw to run commands on exposed systems.
  • Tue 3 Nov, 06:30 UTC. The Hacker News, its first report on the story. Attackers exploit Siemens IoT2050 flaw to install backdoors.
  • Tue 3 Nov, 13:01 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical Node-RED Flaw to Deploy Malware.
  • Mon 9 Nov, 04:01 UTC. SecurityOnline. Weekly report flags attacks on Siemens, Zyxel and Sogou.
All coveragerunning total5SecurityOnl…3The Hacker…1SecurityWeek113 Aug12 Sep12 OctNow
  • First report
  • Article
  • Running total
Show as table
5 articles about CVE-2026-58115 from 3 outlets
Published (UTC)OutletHeadline
12 Aug 09:51SecurityOnlineSiemens warns of CVE-2026-58115 RCE in SIMATIC IoT2050 devices
3 Nov 01:30SecurityOnlineAttackers exploit Node-RED flaw to run commands on exposed systems
3 Nov 06:30The Hacker NewsAttackers exploit Siemens IoT2050 flaw to install backdoors
3 Nov 13:01SecurityWeekAttackers Exploit Critical Node-RED Flaw to Deploy Malware
9 Nov 04:01SecurityOnlineWeekly report flags attacks on Siemens, Zyxel and Sogou
  1. Weekly report flags attacks on Siemens, Zyxel and Sogou
    SecurityOnline
  2. Attackers Exploit Critical Node-RED Flaw to Deploy Malware
    SecurityWeek
  3. Attackers exploit Siemens IoT2050 flaw to install backdoors
    The Hacker News
  4. Attackers exploit Node-RED flaw to run commands on exposed systems
    SecurityOnline
  5. Siemens warns of CVE-2026-58115 RCE in SIMATIC IoT2050 devices
    SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in