Siemens SIMATIC IoT2050 Advanced gateways running Industrial OS with Node-RED installed are being attacked in the wild. The flaw, CVE-2026-58115, is a maximum-severity 10.0 and needs no credentials at all.
What happened
The Node-RED HTTP interface on the device does not enforce authentication. Anyone who can reach that interface can create a flow, and Node-RED flows can run system commands. The result is unauthenticated remote code execution on the gateway with maximum privileges.
VulnCheck reported live exploitation this week. Siemens published the advisory in August 2026 and fixed the problem in Industrial OS 4.3.4.1.
Who is affected
- SIMATIC IoT2050 Advanced, order number 6ES7647-0BA00-1YA2, all versions below 4.3.4.1
- Only devices running Industrial OS with Node-RED installed - the Node-RED component is the exposed surface
- Any gateway whose web interface is reachable from the plant network or, worse, from the internet
What to do now
Upgrade Industrial OS to 4.3.4.1 or later, and until that is done treat every reachable IoT2050 as compromised rather than merely at risk.
- Inventory which IoT2050 units exist, what firmware they run, and whether Node-RED is installed
- If Node-RED is not needed in production, uninstall it - that removes the exposure entirely
- Where Node-RED must stay, enable HTTPS, put credentials in front of the editor and admin API, and restrict the port to known hosts
- Block the device web interface at the firewall boundary while you patch
- After patching, review the Node-RED flows and the OS for unexpected changes, scheduled tasks and outbound connections
What this means for South African businesses
Industrial gateways are rarely treated like servers. They sit on a flat plant network, get commissioned once, and then go years without firmware attention, which is precisely the profile an unauthenticated root-level bug rewards. In a South African manufacturing or processing plant the realistic risk is not espionage but a line stoppage: whoever gets code execution on the gateway can also reach the controllers and HMIs behind it. If your OT estate has never been inventoried for Siemens edge devices, assume some of it is exposed until you have checked.
Source
Reported by The Hacker News, with the technical record in the Siemens-assigned CVE entry.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.