Siemens advisory SSA-834709 (updated 4 November 2026) details CVE-2026-58115: missing authentication on the Node-RED HTTP interface on SIMATIC IoT2050 devices running Industrial OS, letting an unauthenticated remote attacker create malicious flows and run code at maximum privilege (CVSS 10.0). Fixed in Industrial OS V4.3.4-1 or later; alternatively remove/harden Node-RED. Independent reporting describes in-the-wild exploitation.

What it means: Greek industrial, logistics and building operators using SIMATIC IoT2050—or any internet-exposed Node-RED—should immediately check exposure and upgrade or uninstall. Isolate OT interfaces from the internet, require adminAuth and restrict source IPs. Review flows for unexpected exec nodes or HTTP endpoints that may be webshells. Greek automation vendors must notify customers with affected devices and document patch status. OT maintenance contracts should define security-update windows and remote inventory. The case shows low-code ICS tooling is now mass-exploited—include it in vulnerability management beside PLCs. After patching, verify integrity and rotate credentials. Do not leave lab Node-RED instances on public cloud VMs without access control. In practice, teams should name an owner, update the risk register and agree success criteria within 30 days. Where suppliers or customers are affected, send a short notice that points to the primary source and avoids overstated claims. Compliance, cybersecurity and payments operations are linked; a change in one area often requires a pass over contracts, access rights and continuity plans. Finally, keep a review date so the item becomes concrete actions for the Greek business rather than newsletter noise alone.

Read the original on Siemens ProductCERT / SecurityWeek

Related service: Custom software

Related stories