Siemens SIMATIC IoT2050 Node-RED Unauthenticated Remote Code Execution

Technical Analysis

The flaw stems from Node-RED's HTTP administration interface being exposed without authentication enforcement on affected SIMATIC IoT2050 devices (versions prior to V4.3.4.1). Node-RED's flow-based programming model includes function and exec nodes capable of invoking OS-level system commands; without authentication, any network-adjacent or internet-facing attacker can deploy a malicious flow to gain command execution with root/maximum privileges on the underlying Linux-based server. This is a textbook unauthenticated RCE (CWE-306: Missing Authentication for Critical Function) affecting industrial edge gateways that often bridge OT networks to enterprise IT and cloud services. Given the maximum CVSS score and lack of required user interaction, exploitation is trivial and could be automated at scale by scanning for exposed Node-RED instances. For organizations deploying AI agents or automation pipelines that use Node-RED as an orchestration layer for IoT/OT data ingestion into RAG pipelines or agentic workflows, compromise of this interface could allow attackers to inject malicious flows, exfiltrate credentials/API keys used by connected agent systems, or pivot into downstream AI-driven automation infrastructure.

Affected Systems

Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions prior to V4.3.4.1, when running Industrial OS with Node-RED installed and its HTTP interface exposed without authentication.

Indicators of Compromise

• No specific IOCs published; monitor for anomalous Node-RED flow deployments, unexpected exec/system command node usage, and unauthorized HTTP requests to Node-RED admin endpoints (default port 1880) on SIMATIC IoT2050 devices.

Remediation Steps

1. 1

   Apply Vendor Patch

   Update SIMATIC IoT2050 Advanced devices to V4.3.4.1 or later as released by Siemens to enforce authentication on the Node-RED HTTP interface.

2. 2

   Restrict Network Exposure

   Ensure Node-RED HTTP interfaces are not exposed to untrusted networks or the internet; place devices behind firewalls/VPNs and restrict access to trusted management networks only.

3. 3

   Enable Node-RED Authentication

   Configure Node-RED's built-in adminAuth settings to require credentials for accessing the editor and HTTP API, even if a firmware update is pending.

4. 4

   Audit Existing Flows

   Review deployed Node-RED flows for unauthorized or suspicious nodes, particularly exec/system command nodes, and remove any unrecognized flows.

5. 5

   Network Segmentation

   Segment IoT2050 devices from critical OT/IT systems and monitor traffic to/from these devices for anomalous behavior indicative of exploitation.