Siemens has added three more SIMATIC IoT2050 models to the affected-products list for CVE-2026-58115, a critical missing-authentication flaw in Node-RED. The company’s updated advisory SSA-834709 now lists the IoT2050 Basic, IoT2050 M.2 and IoT2050 SM alongside the IoT2050 Advanced.
All four models are affected when running Industrial OS versions earlier than V4.3.4-1 with Node-RED installed. Siemens says the unauthenticated Node-RED HTTP interface can let a remote attacker create malicious flows and execute arbitrary code on the underlying device with maximum privileges. The advisory retains a CVSS score of 10.0.
The update, dated November 4, clarifies the affected-product list; Siemens released the fix on August 11. Version V4.3.4-1 or later addresses the flaw across the four listed models. Exploit attempts against IoT2050 Advanced devices were previously reported after VulnCheck observed activity against its canary systems on October 30, including attempts to deploy a Linux bot.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
