Loading story…
Siemens disclosed CVE-2026-58115, a critical authentication bypass in SIMATIC IoT2050 Advanced and Advanced PG devices running Industrial OS with Node-RED installed. The flaw affects the Node-RED HTTP interface, which lacks authentication and allows unauthenticated remote attackers to access programming functions, send crafted requests to the /flows API, and deploy malicious flows that execute arbitrary operating system commands with root privileges. The issue is tracked as CWE-306 and carries a CVSS 3.1 score of 10.0.
The vulnerability affects all versions earlier than V4.3.4.1 when Node-RED is installed; devices without Node-RED are not impacted. Siemens released V4.3.4.1 to fix the issue. Reporting indicates there was no public proof-of-concept or confirmed active exploitation at publication, but the exposure is significant because SIMATIC IoT2050 devices often connect corporate IT and OT networks, raising the risk of operational disruption and potential downstream effects on connected PLCs and industrial processes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
productcert@siemens.com newly received CVE-2026-58115 on August 11, 2026. The vulnerability affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.
Siemens disclosed CVE-2026-58115 as a critical missing-authentication flaw in the Node-RED HTTP interface of SIMATIC IoT2050 Advanced and Advanced PG devices, enabling unauthenticated remote code execution with maximum privileges. Siemens stated that all versions earlier than V4.3.4.1 are affected and that version V4.3.4.1 contains the fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026
Siemens RUGGEDCOM ROX industrial networking devices contain a **critical** OS command injection flaw, tracked as `CVE-2025-40949`, in the Scheduler function of the Web UI. The vulnerability stems from improper input validation in the task scheduling backend, allowing an authenticated remote attacker to inject arbitrary commands and execute them with **root privileges** on the underlying operating system. The issue carries a **CVSS v3.1 score of 9.1** and was reported by researchers at the Palo Alto Networks OT Threat Research Lab. Affected products include multiple Siemens RUGGEDCOM ROX lines, including **MX5000**, **MX5000RE**, **RX1400**, **RX1500-series**, **RX1536**, and **RX5000** devices running versions earlier than **2.17.1**. CISA republished Siemens ProductCERT guidance urging organizations to upgrade to fixed releases, restrict network exposure, and follow Siemens industrial security recommendations to reduce the risk of exploitation in operational technology environments.
Jun 29, 2026
Rockwell Automation, Siemens, and Schneider Electric issued July industrial security advisories covering dozens of OT vulnerabilities, with Rockwell disclosing multiple high-impact flaws in control and I/O products. The most severe Rockwell issue, **CVE-2026-10577**, affects `1715 Redundant IO` and exposes a network-accessible debug port without authentication, allowing remote attackers to run intrusive CLI commands, read or delete files, stop tasks, modify memory, and change I/O states; the flaw carries a **CVSS v4.0 score of 10.0**. Rockwell also reported **CVE-2026-9636**, a CIP Security certificate revocation handling weakness in several `CompactLogix 5380`, `ControlLogix 5580`, `GuardLogix 5580`, and `1756-EN4` devices that could let a network attacker connect with a certificate that should no longer be trusted, and **CVE-2025-11698**, a buffer overflow in Logix controller recovery images that can trigger a major non-recoverable fault and cause denial of service. Separately, CERT VDE published **VDE-2026-031** for **CVE-2026-4769**, a critical **WAGO System I/O Field** vulnerability caused by an undocumented internal diagnostic function exposed without authentication during early boot. An unauthenticated remote attacker can exploit the startup window to access internal system processes and fully compromise affected `0765-series` devices; the issue is rated **CVSS 3.1 9.8** and **CVSS 4.0 9.3**. Siemens also disclosed **CVE-2025-40945**, an untrusted search path flaw in the IAM Client SDK used across products including `COMOS`, `Designcenter NX`, `Simcenter`, `Solid Edge`, `Teamcenter Visualization`, and `Tecnomatix`, enabling local privilege escalation for authenticated users and reinforcing the breadth of current patching demands across industrial environments.
Jul 17, 2026