CISA republishes Siemens advisory on Node-RED flaw in SIMATIC IoT2050
CISA republished Siemens ProductCERT advisory SSA-834709 for a critical vulnerability in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.
CISA republished a Siemens advisory on Aug. 25 warning of a critical vulnerability in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.
CISA said an unauthenticated remote attacker could create malicious flows through the Node-RED HTTP interface and execute arbitrary code on the underlying server with maximum privileges.
The advisory identifies the issue as a missing authentication flaw, tracked as CVE-2026-58115 and CWE-306. It assigns the issue a CVSS v3.1 base score of 10.0 and labels it critical, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
CISA said the affected product is Siemens SIMATIC IoT2050 Advanced, part number 6ES7647-0BA00-1YA2, when it is running Industrial OS with Node-RED installed at versions below V4.3.4.1. The advisory lists the product status as known affected.
According to the advisory, Siemens ProductCERT reported the vulnerability to CISA. CISA republished Siemens ProductCERT advisory SSA-834709 and said Siemens strongly recommends updating to V4.3.4.1 or later through Siemens support. The advisory also lists hardening the Node-RED installation or uninstalling Node-RED as mitigation options.
In the background section of the advisory, CISA said the device is deployed worldwide and cited critical infrastructure sectors including Chemical, Critical Manufacturing, Energy and Transportation Systems.
CISA also repeated general defensive guidance for control systems. It said operators should minimize network exposure, keep control system devices off the internet, place control system networks and remote devices behind firewalls, isolate them from business networks and use VPNs for remote access when needed.
The advisory also notes that VPNs can have vulnerabilities and should not be treated as a complete safeguard.
The advisory revision history lists an initial release date of Aug. 11 and CISA republication on Aug. 25.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()