CVE-2026-58115 is a critical vulnerability affecting Siemens SIMATIC IoT2050 Advanced devices. The vulnerability has been assigned a CVSS score of 10.0, indicating its severity. It allows unauthenticated remote attackers to create malicious flows and execute arbitrary code on affected devices.
The flaw arises from missing authentication for the Node-RED HTTP interface. Exploitation of this vulnerability has been confirmed, with attackers observed deploying a Node-RED flow that downloads and runs a Linux bot. The malicious flow can execute commands immediately upon deployment without further interaction.
VulnCheck confirmed the attack, logging 16 attempts from a single IP address. The IP address, 4.201.105.116, is part of Microsoft's ASN (AS8075) and geolocates to Brazil.
Siemens has released patches for this vulnerability in Industrial OS version 4.3.4.1 and later. The exploit targets Linux on AMD64 architecture, allowing attackers to run arbitrary commands by passing them in a query parameter.
The vulnerability has been added to VulnCheck's Known Exploited Vulnerabilities catalog. However, as of November 1, 2026, it had not appeared in the US Cybersecurity and Infrastructure Security Agency’s KEV catalog.