CVE-2026-58115: Siemens SIMATIC IoT2050 Advanced (Critical, CVSS 10)
- CVSS
- 10 Critical (v4.0)
- EPSS
- 0.9% chance of exploitation in the next 30 days (higher than 59.4% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 1 GitHub repository
- Weakness
- CWE-306
- Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H- Published
- Aug 11, 2026
What it is
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
Description from the National Vulnerability Database.
What to do
Check whether you run Siemens SIMATIC IoT2050 Advanced, then apply the vendor’s fix or mitigation from the advisories below. Because this flaw is exploited or has public exploit code, treat it as urgent and check for signs of compromise, not just the patch level.
ThreatRoundup coverage
Node-RED’s Perfect-10 Bug Is Now Being Used to Plant Linux Bots
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.