Skip to content
OpenAdvisories
Critical ICSA-26-237-03 1 CVE

Siemens SIMATIC IoT2050 Advanced

Published Aug 11, 2026 · Updated Nov 12, 2026 · Revision 5

Vendor: Siemens Product: SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) Product: SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) Product: SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) Product: SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)

Summary

SIMATIC IoT2050 devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

Vulnerabilities 1

Revision history

  1. #5

    CISA Republication update based on Siemens ProductCERT SSA-834709 advisory

  2. #4

    Added additional affected configuration for SIMATIC IoT2050 family

  3. #3

    Clarified Affected products list. Updated title. Updated summary.

  4. #2

    CISA Republication - Initial CISA Republication of Siemens ProductCERT SSA-834709 advisory

  5. #1

    Publication Date

References