Unauthenticated Access Issue in SIMATIC IoT2050 Advanced by Siemens
CVE-2026-58115

10CRITICAL

Key Information:

Vendor

Siemens
Status
Simatic Iot2050 Advanced
Vendor
CVE Published:
11 August 2026

What is CVE-2026-58115?

A significant security vulnerability exists within the SIMATIC IoT2050 Advanced device, where the Node-RED HTTP interface does not enforce proper authentication. This oversight permits unauthorized users to access programming nodes and execute system commands on the server. As a result, an attacker could manipulate these capabilities to create malicious flows that execute arbitrary code with elevated privileges, potentially compromising the entire system's integrity.

Affected Version(s)

SIMATIC IoT2050 Advanced 0

References

https://cert-portal.siemens.com/productcert/html/ssa-8347...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.