A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.
This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
References
Configurations
No configuration.
History
23 Oct 2026, 21:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) Se ha identificado una vulnerabilidad en SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (Todas las versiones anteriores a V4.3.4.1 que ejecutan Industrial OS con Node-RED instalado). Los dispositivos afectados no aplican autenticación en la interfaz HTTP de Node-RED, lo que permite el acceso no autenticado a nodos de programación que son capaces de ejecutar comandos del sistema en el servidor. Esto podría permitir a un atacante remoto no autenticado crear flujos maliciosos a través de la interfaz HTTP para ejecutar código arbitrario en el servidor subyacente con privilegios máximos. |
23 Oct 2026, 19:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
Information
Published : 2026-08-11 13:19
Updated : 2026-10-23 21:10
NVD link : CVE-2026-58115
Mitre link : CVE-2026-58115
CVE.ORG link : CVE-2026-58115
JSON object : View
Products Affected
No product.
CWE
CWE-306
Missing Authentication for Critical Function