Siemens IoT2050 Node-RED Ships Without Authentication

CVE-2026-58115 isn't a memory-safety flaw or a parsing bug. It's simpler than that: the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS simply doesn't check whether you're supposed to be there. Anyone who can reach the interface can create flows (Node-RED's visual programming constructs) that execute arbitrary system commands. The CVSS vector tells the story: AV:N (network-reachable), AC:L (no special conditions), PR:N (no privileges), UI:N (no user interaction), S:C (scope change, the compromised Node-RED component hands over the underlying OS), with high impact across confidentiality, integrity, and availability. That's a 10.0, and it's earned.

Siemens has released version 4.3.4.1, available through its support portal. For organizations that can't patch immediately (a common constraint in ICS environments where change windows are months apart) the advisory offers two compensating controls: harden the Node-RED installation per Siemens' Node-RED User Guide, or uninstall Node-RED entirely. The second option is blunt but effective; Node-RED is an optional component and removing it eliminates the attack surface. Network isolation (keeping the IoT2050 off internet-facing and IT networks) is the universal backstop CISA reiterates in every ICS advisory, but the CVSS vector's attack-complexity-low rating means even internal-network exposure is dangerous if an attacker gains any foothold.

Inventory every SIMATIC IoT2050 Advanced in the fleet. Check the Industrial OS version, anything below 4.3.4.1 is vulnerable. If Node-RED isn't a required service, remove it now. If it is required, restrict access to the HTTP interface at the network layer and work the patch into the next available maintenance window. The four affected critical infrastructure sectors should treat this as a priority remediation, not a routine patch cycle item.