CVE-2026-58115

CVE-2026-58115 is a missing authentication vulnerability affecting the Node-RED HTTP interface bundled with Siemens SIMATIC IoT2050 Advanced devices running Industrial OS (versions prior to V4.3.4.1). Because the Node-RED editor and admin API are exposed without access control by default, an unauthenticated remote attacker with network access can reach the programming interface. By deploying malicious flows containing built-in nodes—such as `exec` or `function` nodes—attackers can execute arbitrary system commands on the underlying server. In late October 2026, security researchers observed active exploitation of this vulnerability in the wild. Attackers targeted exposed instances by sending HTTP POST requests to deploy malicious flows, which automatically downloaded Linux bot payloads and established persistent web shells to execute remote commands. Siemens has addressed the issue in Industrial OS version V4.3.4.1 and later. For standalone Node-RED installations, administrators are advised to enable the `adminAuth` setting and restrict the editor from public internet access.