{"history":[{"alert":0,"cve":"CVE-2026-58115","id":23388,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.0089, \"percentile\": 0.59833}"},{"alert":1,"cve":"CVE-2026-58115","id":21144,"kind":"cna","observed_at":1794435601,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-58115\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-08-12T17:59:33.476267Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-12T19:19:54.001Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"*\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"*\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"*\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"*\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions running Example Image versions with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.\\r\\nThis could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"cvssV4_0\": {\"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"version\": \"4.0\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T11:30:34.321Z\", \"orgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"shortName\": \"siemens\"}, \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-834709.html\"}]}}, \"cveMetadata\": {\"assignerOrgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"assignerShortName\": \"siemens\", \"cveId\": \"CVE-2026-58115\", \"datePublished\": \"2026-08-11T12:20:24.045Z\", \"dateReserved\": \"2026-06-29T12:59:54.795Z\", \"dateUpdated\": \"2026-11-10T11:30:34.321Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2026-58115","id":20869,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.0089, \"percentile\": 0.59665}"},{"alert":0,"cve":"CVE-2026-58115","id":18961,"kind":"epss","observed_at":1794306001,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.0089, \"percentile\": 0.59618}"},{"alert":1,"cve":"CVE-2026-58115","id":18878,"kind":"cna","observed_at":1794306001,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-58115\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-08-12T17:59:33.476267Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-12T19:19:54.001Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unknown\", \"product\": \"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)\", \"vendor\": \"Siemens\", \"versions\": [{\"lessThan\": \"V4.3.4-1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.\\r\\nThis could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"cvssV4_0\": {\"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"version\": \"4.0\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-04T17:45:30.430Z\", \"orgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"shortName\": \"siemens\"}, \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-834709.html\"}]}}, \"cveMetadata\": {\"assignerOrgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"assignerShortName\": \"siemens\", \"cveId\": \"CVE-2026-58115\", \"datePublished\": \"2026-08-11T12:20:24.045Z\", \"dateReserved\": \"2026-06-29T12:59:54.795Z\", \"dateUpdated\": \"2026-11-04T17:45:30.430Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-58115","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-12T17:59:33.476267Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-12T19:19:54.001Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)","vendor":"Siemens","versions":[{"lessThan":"V4.3.4-1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions running Example Image versions with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.\r\nThis could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges."}],"metrics":[{"cvssV3_1":{"baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},{"cvssV4_0":{"baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T11:30:34.321Z","orgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","shortName":"siemens"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-834709.html"}]}},"cveMetadata":{"assignerOrgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","assignerShortName":"siemens","cveId":"CVE-2026-58115","datePublished":"2026-08-11T12:20:24.045Z","dateReserved":"2026-06-29T12:59:54.795Z","dateUpdated":"2026-11-10T11:30:34.321Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794435601,"cve":"CVE-2026-58115","description":"A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions running Example Image versions with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions running Example Image versions with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.\r\nThis could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.","epss":{"date":"2026-11-12","epss":0.0089,"percentile":0.59833},"epss_checked":1794522003,"first_seen":1794294011,"kev":null,"kev_checked":1794522003,"products":"Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Siemens SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2), Siemens SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2), Siemens SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)","references":["https://cert-portal.siemens.com/productcert/html/ssa-834709.html"],"score":{"baseScore":10,"baseSeverity":"CRITICAL","provider":"siemens","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"solutions":"","state":"PUBLISHED","title":"CVE-2026-58115","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.vulncheck.com/blog/exploitation-targeting-node-red","id":316,"publisher":"VulnCheck","title":"Exploitation Targeting Node-RED, a Tool Embedded in ICS Products | Blog | VulnCheck"}]}