TOPIC
Exact CVE/product/version identity; Node-RED missing-authentication RCE; affected/fixed state; exploitation-state timeline; OT/edge exposure boundaries; remediation/segmentation; confirmed-versus-unconfirmed victim impact; attribution/campaign limits.
1
4
4
4
4
NEW — Siemens CVSS 10 unauthenticated maximum-privilege RCE verified; historical Aug CISA Exploitation:none preserved; VulnCheck KEV added Oct-30 and VulnCheck-origin reporting records canary attempts Oct-30/31. No current CISA-KEV claim is made. Successful compromise, exposure denominator, realized OT/safety impact and attribution remain gated.
VULNERABILITY_EXPLOITATION_RESEARCH_TOPIC
—
—
—
CVE-2026-58115 is a currently operationally relevant exploitation risk on affected SIMATIC IoT2050 Advanced systems: unauthenticated maximum-privilege RCE plus fresh late-October VulnCheck exploitation signals.
Raw VulnCheck telemetry and independent confirmed-success victim IR.
Effective remediation requires V4.3.4.1+ or removal/hardening of Node-RED; segmentation/network-access controls are defense-in-depth.
Asset version/configuration inventory and deployment telemetry.
Current exploitation activity has produced successful operational-industrial compromise with process manipulation or safety impact.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 4 Evidence
SIMATIC IoT2050 Advanced <V4.3.4.1 with Industrial OS + Node-RED lacks authentication on the Node-RED HTTP interface; unauthenticated remote attackers can create malicious flows and execute arbitrary code with maximum privileges. Siemens rates CVSS 10.0 and provides V4.3.4.1+ plus Node-RED/network mitigations.
لا يثبت: Current exploitation prevalence, successful victims, actor/campaign identity, exposure denominator or realized process/safety impact.
فتح Run المصدرCISA ICS material tracks the same affected Siemens product, unauthenticated command-execution impact and V4.3.4.1 remediation. CISA ADP/Vulnrichment on 2026-08-12 recorded Exploitation:none, Automatable:yes, Technical Impact:total.
لا يثبت: The August Exploitation:none value does not refute later October telemetry and does not prove current CISA KEV inclusion.
فتح Run المصدرA current tracked record reports CVE-2026-58115 added to VulnCheck KEV on 2026-10-30, creating a fresh exploitation-state delta relative to the August CISA ADP record.
لا يثبت: CISA KEV inclusion, victim count, successful persistent compromise, actor/campaign identity, payload behavior or physical/safety effects.
فتح Run المصدرThe Exploit Bulletin reports VulnCheck Canary sensors observed exploitation attempts against CVE-2026-58115 on 2026-10-30 and 2026-10-31; it repeats Siemens affected/fixed state and mitigation guidance.
لا يثبت: Independent second exploitation origin, successful victim compromise, actor attribution, payloads or OT process manipulation.
فتح Run المصدرPrimary victim/IR evidence with process/system telemetry.
The observed exploitation belongs to one attributable actor/campaign with measurable victim scale or ransomware/physical-impact objective.
Independent actor-linked infrastructure, repeated victim artifacts or authoritative attribution.
No public authoritative denominator of successful compromises, attack volume, victims or affected-sector distribution for CVE-2026-58115.
VulnCheck raw telemetry, Siemens/CERT victim reporting or multi-victim IR/provider evidence.
No reliable public denominator of reachable vulnerable SIMATIC IoT2050 Advanced devices with Node-RED enabled and affected versions.
Version/config-aware asset telemetry or authenticated inventory.
No public primary incident evidence recovered for payload behavior, process manipulation, safety effects, persistence or downstream post-exploitation actions on a successfully compromised victim.
Victim/IR artifacts, process telemetry, payload samples or authoritative incident disclosure.
Actor identity, infrastructure, campaign clustering, motives and ransomware relationship remain unproven.
Independent actor-linked infrastructure, repeated incident artifacts or authoritative attribution.
PAYLOAD_OT_IMPACT
ATTRIBUTION_CAMPAIGN
فتح Run