CVE-2026-58115

Executive Summary

CVE-2026-58115 is a critical, unauthenticated remote code execution vulnerability affecting the SIMATIC IoT2050 Advanced device (6ES7647-0BA00-1YA2) when running Industrial OS with Node-RED installed (versions older than V4.3.4.1). The flaw stems from the absence of authentication enforcement on the Node-RED HTTP interface, which permits any network-reachable actor to access programming nodes and execute arbitrary system commands with maximum privileges. With a CVSS score of 10.0 (Critical), an unauthenticated attacker can remotely create malicious flows, achieve full server compromise, and pivot to adjacent systems. No patch, public exploit, or CISA KEV listing exists at the time of this report.

Technical Analysis

The vulnerability is rooted in CWE-306: Missing Authentication for Critical Function. The SIMATIC IoT2050 Advanced device ships with a pre-installed Node-RED runtime (a flow-based visual programming tool) that exposes an HTTP-based editor/API interface. In affected firmware versions (all versions before V4.3.4.1 running Industrial OS with Node-RED installed), this interface is configured without authentication enforcement — meaning no login, API key, or session token is required to interact with the Node-RED programming environment.

Node-RED's architecture is significant here: its core functionality revolves around "flows" — connected nodes that process messages, call functions, and interact with external services. Critically, Node-RED includes a function node category that executes embedded JavaScript on the underlying server. Because Node-RED runs with the privileges of the process that launched it (typically root or a high-privilege service account in industrial appliance deployments), any JavaScript executed via the Function node runs with those same elevated privileges.

The attack surface is the Node-RED HTTP interface, which typically listens on TCP port 1880 (the default Node-RED HTTP port). Siemens did not provide specific port details in the advisory, but based on Node-RED's standard deployment, the editor and HTTP API are bound to port 1880 by default. The NVD description explicitly states "allowing unauthenticated access to programming nodes that are capable of executing system commands on the server" — this confirms that the exposed nodes include those that support arbitrary command execution (e.g., an exec-type node or the Function node calling child_process.execSync from JavaScript).

The vulnerability class is network-accessible, unauthenticated arbitrary code execution. The mechanism is straightforward: the HTTP API exposes endpoints that allow creating, modifying, and deploying Node-RED flows. Without authentication, a remote attacker can programmatically POST a new flow definition containing a malicious Function node. When the flow is deployed, the Node-RED runtime evaluates the embedded JavaScript on the server, executing arbitrary OS commands with maximum privileges (root/NT AUTHORITY). Additional technical details, such as the exact URL endpoints (e.g., /flows, /auth/token) or Node.js API specifics, are not explicitly provided in the NVD description. Insufficient technical detail is available regarding the precise HTTP request formats; the attack is understood at the vulnerability-class level.

The CVSS vector — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — confirms: Network-reachable, Low attack complexity, No privileges required, No user interaction, and Scope Changed (the compromise extends beyond the vulnerable component to the entire host device and potentially the connected OT network). Base score 10.0 reflects maximum impact across confidentiality, integrity, and availability.

Exploitation Scenarios

Note: No public PoC or exploit code is available (PoC: UNKNOWN). The attack chain below is inferred strictly from the vulnerability class (CWE-306 — Missing Authentication) and the NVD description, without fabricating specific function names or endpoint paths not present in the description.

Step 1 — Reconnaissance / Target Identification: An attacker first identifies exposed SIMATIC IoT2050 Advanced devices on the network or internet. Shodan/Censys queries for Node-RED's default HTTP interface (http.title:"Node-RED", port:1880) or device-specific banners ("SIMATIC", "Industrial OS") can trivially locate candidates. Once found, the attacker performs a simple HTTP GET request to the root path of the Node-RED editor. In an unauthenticated deployment, the server responds with the editor HTML/JSON without any 401/403 authentication challenge — immediately confirming the missing authentication flaw.

Step 2 — Flaw Class Trigger: The attacker interacts with the Node-RED HTTP API (the "programming nodes" interface). Because authentication is not enforced, the attacker can invoke the flow-management endpoints to list, create, modify, and deploy flows. The NVD description states that the affected devices "do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes." The trigger is simply an unauthenticated HTTP request to the editor/API surface — no credentials, session bypass, or injection technique is required. The flaw is enabled by default; no special request crafting is needed beyond reaching the interface.

Step 3 — Payload / Execution Method (Vulnerability-Class Level): At the vulnerability-class level, the attacker crafts a malicious Node-RED flow definition containing a Function node (the "programming node capable of executing system commands"). The Function node in Node-RED is designed to execute arbitrary JavaScript. Since Node-RED runs with maximum privileges on the underlying server (per NVD: "arbitrary code on the underlying server with maximum privileges"), the embedded JavaScript can invoke OS-level command execution (e.g., spawning a reverse shell, downloading and executing a dropper, or modifying system files). The attacker deploys this flow via the HTTP API. Upon deployment, the Node-RED runtime evaluates the JavaScript, which executes the embedded OS command with root-level privileges.

The NVD description explicitly confirms this capability: "create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges."

Step 4 — Post-Exploitation Impact: Once arbitrary code execution with maximum privileges is achieved, the attacker gains full control of the SIMATIC IoT2050 Advanced. This is an industrial IoT edge device, meaning the impact extends to the operational technology (OT) environment it bridges. The attacker can:

• Read/modify local files, including configuration data, credentials, and industrial process data.
• Pivot from the edge device into the connected OT/SCADA network, targeting PLCs, HMIs, or other controllers.
• Disrupt device operation (availability impact), potentially halting manufacturing or energy processes.
• Establish persistent backdoor access (e.g., writing a reverse shell into the Node-RED startup flows).
• Use the device as a launchpad for lateral movement in both IT and OT domains, given the scope-changed classification in CVSS.
• Because no authentication exists, the attacker can also modify or delete existing legitimate flows, causing immediate operational disruption.

Realistic Attack Vector: An internet or network-edge attacker sends a crafted HTTP request (e.g., HTTP POST or PUT to the flow-deployment endpoint) containing a malicious flow JSON payload. The absence of authentication means the request is accepted and processed with zero trust verification. The injected JavaScript executes OS commands via the Node-RED runtime's process-spawning capabilities, achieving RCE.

Impact Assessment

CVSS Score: 10.0 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• Confidentiality Impact (High): Total disclosure of device filesystem, credentials, industrial data, and network configurations.
• Integrity Impact (High): Arbitrary modification of flows, system binaries, configuration files, and industrial control logic traversing the device.
• Availability Impact (High): Complete denial of service via system compromise, flow deletion, or resource exhaustion.
• Scope Changed (S): The compromise extends beyond the Node-RED component to the entire underlying server OS and potentially the OT network segment.

Business Impact:

• Affected Systems: SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, all versions < V4.3.4.1. This is an edge gateway device designed for connecting industrial machinery to IoT/cloud platforms — a common target in critical manufacturing, energy, and utilities sectors.
• Operational Technology (OT) Risk: The device sits at the IT/OT boundary. Successful exploitation provides a direct bridge from the enterprise network into the OT/SCADA environment, circumventing typical IT-layer security controls.
• Compliance/Regulatory: Potential violation of NERC CIP, IEC 62443, or local industrial cybersecurity regulations depending on sector.
• Blast Radius: A single compromised device can serve as a pivot point to compromise the entire attached OT network. In facilities using multiple IoT2050 Advanced gateways (e.g., across a production line), a single internet-facing instance can expose the entire fleet if network segmentation is poor.
• Ransomware/Cyber-Espionage Risk: Given the maximum-privilege RCE with zero authentication burden, this is a highly attractive target for ransomware operators targeting industrial entities and state-sponsored APT groups seeking OT network access.

Affected Version Range: All versions of the device where firmware is < V4.3.4.1 AND running Industrial OS with Node-RED installed. The vendor's advisory limits the vulnerable condition to this specific configuration. Devices running other OS variants or without Node-RED installed are not flagged by this CVE.

Patch Confidence: 0/4 — UNPATCHED. No verified patch evidence exists from any tracked source. The vendor has not released a firmware update addressing this flaw at the time of writing. This is a zero-day scenario (no known patch, no CISA KEV listing, no public exploit).

Detection Guidance

Sigma Rule

title: Unauthenticated Node-RED Flow Modification Attempt on SIMATIC IoT2050
id: a1be9f5c-1234-4a5b-9cde-f01234567890
status: experimental
description: Detects HTTP requests to the Node-RED HTTP API flow-deployment endpoints originating from unauthenticated sources, indicating potential CVE-2026-58115 exploitation attempts against SIMATIC IoT2050 Advanced devices.
author: Valters IT Threat Intelligence Team
date: 2026/06/01
logsource:
  category: webserver
  product: nginx
  definition: 'Requires web server/API access logs from the SIMATIC IoT2050 running Node-RED; network proxy logs may substitute.'
detection:
  selection_flows:
    cs-method:
      - 'POST'
      - 'PUT'
    cs-uri-query|contains:
      - '/flows'
      - '/nodes'
  selection_noauth:
    sc-status:
      - '200'
      - '201'
  condition: selection_flows and selection_noauth
falsepositives:
  - Legitimate Node-RED flow deployment by authorized administrator if authentication is misconfigured or disabled by policy.
  - Automated management tools that have been granted access.
level: high
tags:
  - attack.t1190
  - attack.t1210
  - cve.2026-58115
  - cwe.306

YARA Rule

rule CVE_2026_58115_NodeRED_MaliciousFlow_Detect
{
    meta:
        author = "Valters IT Threat Intelligence Team"
        date = "2026-06-01"
        description = "Detects malicious Node-RED flow JSON payloads targeting unauthenticated HTTP interfaces on SIMATIC IoT2050 Advanced devices."
        cve = "CVE-2026-58115"
        cwe = "CWE-306"
        reference = "NVD CVE-2026-58115"
    strings:
        $node_type = "\"type\":\"function\"" ascii wide
        $node_type2 = "\\\"type\\\": \\\"function\\\"" ascii wide
        $exec_js = "child_process" ascii wide nocase
        $exec_js2 = "execSync" ascii wide nocase
        $exec_js3 = "spawn(" ascii wide nocase
        $exec_js4 = "exec(" ascii wide nocase
        $curve = "sys_http" ascii wide nocase
    condition:
        (uint16(0) == 0x7B7B or uint16(0) == 0x7B20) and // { { or { space
        filesize < 2MB and
        (2 of ($node_type*)) and
        (1 of ($exec_js*) or 1 of ($exec_js* variants)) and
        (2 of ($node_type*) and 1 of ($exec_js*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-58115 - SIMATIC IoT2050 Node-RED Unauthenticated Flow Deployment Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/flows"; http_uri; content:"type"; http_client_body; content:"function"; http_client_body; content:"code"; http_client_body; content:"child_process"; http_client_body; nocase; classtype:attempted-admin; sid:202658115; rev:1; priority:1; reference:cve,2026-58115;)

Elastic Detection

// EQL query for Elastic SIEM / Elastic Security
sequence by host.name with maxspan=1m
  [network where event.action == "connection_attempted" and destination.port in (1880, 80, 443) and process.name == "node" and destination.ip != "127.0.0.1"]
  [http where request.method == "POST" and url.path in ("/flows", "/nodes") and request.body.text contains "function"] 
  [process where event.action == "exec" and process.parent.name == "node" and (process.args contains "--eval" or process.command_line contains "node")]

Splunk SPL Query

index=proxy OR index=webserver 
  (sourcetype="access_combined" OR sourcetype="iis")
  (uri_path="/flows" OR uri_path="/nodes" OR uri_path="/settings")
  http_method IN ("POST", "PUT")
  | eval auth_status = case(status == 401, "authenticated_blocked", status == 200, "unauthenticated_success")
  | where auth_status == "unauthenticated_success"
  | stats count by src_ip, dest_ip, uri_path, http_method, status
  | where count > 3
  | rex field=_raw "body=(?P<body>.*)"
  | search body="function" OR body="child_process"
  | table _time, src_ip, dest_ip, uri_path, http_method, status, count, body

Wazuh OSSEC Rule

<group name="cve_2026_58115,">
  <rule id="581150" level="15">
    <if_sid>ID_OF_WEBSERVER_ACCESS_GROUP</if_sid>
    <field name="url">/flows</field>
    <field name="method">POST|PUT</field>
    <description>CVE-2026-58115: Unauthenticated flow modification attempt detected on Node-RED interface (SIMATIC IoT2050).</description>
    <group>attack.t1190,cwe.306,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="581151" level="15">
    <if_sid>581150</if_sid>
    <regex>(type.*function|child_process|execSync|spawn\()</regex>
    <description>CVE-2026-58115: Malicious Node-RED flow payload with system command execution, possible RCE attempt.</description>
    <group>attack.t1190,cwe.306,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (0/4 confidence). No official vendor firmware update is available at the time of writing. The vendor has not released a patched version (V4.3.4.1 or later) that addresses this flaw; the affected version range is all versions < V4.3.4.1. Given the absence of any patch, the following interim measures are the only available defenses.

1) Immediate Mitigations (Compensating Controls):

• Network Segmentation & Firewall Rules: Place the SIMATIC IoT2050 Advanced behind a strict firewall. Block all inbound access to Node-RED's HTTP port (default 1880; identify the actual listening port via netstat or device logs) from any network segment not explicitly requiring access. Do NOT expose the Node-RED interface to the internet or general corporate LAN.
• Access Control Lists (ACLs): If the Node-RED interface must be reachable, restrict access by source IP to only known administrative workstations via ACL/firewall rules.
• Reverse Proxy with Authentication: If business needs require the interface, deploy a reverse proxy (e.g., Nginx, Envoy) in front of the Node-RED HTTP interface that enforces mandatory authentication (e.g., HTTP Basic Auth, client certificates, or OAuth2) before forwarding traffic. This provides a compensating control for the missing application-level authentication.
• VPN Requirement: Force all remote access to the device to traverse a hardened VPN gateway with multi-factor authentication.
• Disable Node-RED if Unnecessary: If Node-RED is not actively used for industrial workflows, uninstall it entirely or disable the service. The vulnerability only applies "with Node-RED installed" — removing the component eliminates the attack surface.

2) Patch / Upgrade Steps:

• Monitor the Siemens ProductCERT/Industrial Control Systems (ICS) advisory channels continuously for the release of firmware V4.3.4.1 or later.
• Once available, download the firmware update from the official Siemens support portal (support.industry.siemens.com) and apply it to all affected devices following the vendor's update procedure. Validate the firmware hash/signature before deployment.
• Upon patching, verify the Node-RED HTTP interface now enforces authentication (i.e., unauthenticated HTTP requests return 401 Unauthorized). Test by attempting an unauthenticated flow listing after the update.
• Maintain an inventory of all devices running the vulnerable configuration to ensure no instance is missed.

3) Long-Term Hardening:

• Adopt the Principle of Least Privilege: Run Node-RED as a non-root, low-privilege service account, and restrict its OS-level capabilities via systemd CapabilityBoundingSet or equivalent. This limits the blast radius if an attacker can execute code.
• Network Monitoring: Deploy network intrusion detection (Suricata/Snort) and log aggregation (Splunk/ELK) to monitor for unauthenticated HTTP requests to port 1880 or flow-deployment attempts, using the detection rules provided above.
• Logging & Auditing: Enable verbose access logs on the Node-RED HTTP interface and forward them to a central SIEM. Audit all successful flow deployments in production — they should only originate from authenticated admin sessions.
• OT/IT Segmentation: Ensure all industrial IoT gateways are placed in a demilitarized zone (DMZ) with strict egress filtering — no direct path from the corporate network or internet to the OT network.
• Firmware Baseline & Change Management: Establish a change-management process requiring security review of any new firmware or OS-level package installation on industrial devices.
• Threat Hunting: Periodically hunt for anomalies such as node processes spawning shells (/bin/sh, cmd.exe), unusual outbound beaconing from the device, or unexpected modifications to Node-RED flow files.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58115 — Official NVD vulnerability record with description, CVSS vector (10.0), and CWE-306 classification.
2. Siemens ProductCERT Advisory (Recommended Monitoring): https://cert-portal.siemens.com/productcert/ — Siemens publishes security advisories for SIMATIC products here; check for a forthcoming advisory referencing CVE-2026-58115 and firmware V4.3.4.1. Note: No advisory retrieval was possible at the time of writing (patch confidence 0/4).
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Listed as "NO" for CVE-2026-58115; monitor periodically as status may change.
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application, the primary ATT&CK technique for this vulnerability.
5. CWE-306 Reference: https://cwe.mitre.org/data/definitions/306.html — Missing Authentication for Critical Function, the root weakness.

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public exploit code, PoC, nuclei template, or exploit-in-the-wild reports exist at the time of this report (PoC/Exploit: UNKNOWN). No threat actor campaigns have been publicly attributed to this CVE. Given the device family (industrial IoT gateways in OT environments) and the CVSS 10.0 severity, this is a high-value zero-day that is likely to attract state-sponsored and financially motivated activity once exploits become publicly known. The EPSS score has not yet been assigned by FIRST.org, so no exploit-probability modeling is included.