Siemens SIMATIC IoT2050 Advanced
SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. Siemens has released a new version for SIMATIC IoT2050 Advanced and strongly recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-58115US | —OT erhöht | — | ||
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do no… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 Advanced with Industrial OS - CSAF Versionself
- SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 Advanced with Industrial OS - HTML Versionself
- ICS Advisory ICSA-26-237-03 JSONself
- ICS Advisory ICSA-26-237-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (2)
- MitigationSIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)
Harden the Node-RED installation (see Node-RED User Guide)
- BehobenSIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)
Update to V4.3.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109741799/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan