CVE-2026-58115criticalexplotación observadaCWE-306

CVE-2026-58115: fallo crítico en Siemens SIMATIC IoT2050 Advanced…

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SIMATIC IoT2050 Advanced+ Monitorear SIMATIC IoT2050 Basic

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

70Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.

ssvc Actcvss 10epss 0.9%
de la publicación al arma84 días
Publicada en NVD11 ago
1ª PoC+84d
VulnCheck+80d
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
Siemens · SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)Siemens · SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)Siemens · SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)Siemens · SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.