Siemens IoT2050 Flaw Rated 10 of 10 Is Being Exploited in the Wild
An unauthenticated flaw in a Siemens industrial gateway lets anyone on the network run commands as root. Attackers are already using it.
Key points
- Attackers are actively exploiting CVE-2026-58115, a flaw in Siemens SIMATIC IoT2050 Advanced gateways carrying the maximum CVSS score of 10.0.
- The bug sits in Node-RED, a visual programming tool shipped on the device, which exposes an HTTP interface with no login required.
- Siemens fixed the issue in Industrial OS version 4.3.4.1; every earlier build with Node-RED installed is vulnerable.
- The gateway runs in factories and utilities, so a successful attack can reach equipment that controls physical processes.
- Operators should check whether reporting duties under CISA's CIRCIA rules or the EU's NIS2 regime apply before assuming this stays internal.
Siemens customers running the SIMATIC IoT2050 Advanced, a small industrial computer used to bridge factory equipment and corporate networks, are being told to patch now. VulnCheck says attacks are already underway, and The Hacker News first flagged that exploitation activity. CVSS 10.0 is the highest severity the scoring system can assign.
We've tracked Siemens security disclosures closely this year: our 23 July report on Iranian hackers targeting Siemens industrial control systems named the specific techniques used against the programmable logic controllers that run factories and water plants.
The flaw is blunt. Node-RED, a drag-and-drop tool engineers use to wire together data flows, ships on the device. On vulnerable units its web interface requires no password. Anyone who can reach it over the network can build a "flow" that runs system commands, and those commands execute with root privileges.
If an attacker can see the device, they own it.
What exactly is affected?
Every SIMATIC IoT2050 Advanced running an Industrial OS build before 4.3.4.1 with Node-RED installed is exposed. Update to 4.3.4.1 or later. Siemens's ProductCERT advisory is the authoritative source to confirm the fixed build before deploying.
| Item | Detail |
|---|---|
| CVE | CVE-2026-58115 |
| CVSS | 10.0 (critical) |
| Product | SIMATIC IoT2050 Advanced |
| Fixed in | Industrial OS 4.3.4.1 |
| Condition | Node-RED installed |
Why does this matter beyond IT?
Because the IoT2050 is an operational-technology device sitting between office networks and the machines that run physical plants. A hacker who takes over one of these gateways can read sensor data or send commands to connected equipment. That's a very different problem from a stolen database, and it's exactly the scenario our 30 July data-centre exposure piece warned about: infrastructure within one network hop of an attacker.
Regulators are watching. CISA's rule implementing the Cyber Incident Reporting for Critical Infrastructure Act requires covered entities to report substantial cyber incidents once the compliance date arrives. Manufacturing and energy operators running kit like this will be in scope. In the EU, the NIS2 Directive already imposes incident notification obligations on essential and important entities, and operational-technology compromises are explicitly contemplated in ENISA's guidance.
What should operators do right now?
Update to Industrial OS 4.3.4.1, or remove Node-RED if the device doesn't need it. If neither is possible immediately, block the Node-RED HTTP port at the network boundary so the interface can't be reached from outside a trusted segment.
A plain judgement: a CVSS 10 on an OT gateway that ships a management interface with no authentication is something that shouldn't have left engineering. The patch is straightforward. The harder question is how many of these boxes sit on flat networks where the office LAN and the open internet are effectively the same thing.
