Skip to content
OpenAdvisories
Critical SSA-834709 1 CVE

SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 with Industrial OS

Published Aug 11, 2026 · Updated Nov 10, 2026 · Revision 3

Vendor: Siemens Product: SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) Product: SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) Product: SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) Product: SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)

Summary

SIMATIC IoT2050 devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

Vulnerabilities 1

Revision history

  1. #3

    Added additional affected configuration for SIMATIC IoT2050 family

  2. #2

    Clarified Affected products list. Updated title. Updated summary.

  3. #1

    Publication Date

References