Plan ahead High Patch available
Siemens releases fixes for Node-RED flaw on SIMATIC IoT2050
Siemens ProductCERTSiemens, SIMATIC IoT2050, Node-RED
What happened. New: Siemens has released new versions for the affected SIMATIC IoT2050 products. The Node-RED web interface has no authentication, so a remote attacker could create malicious flows and run code with maximum privileges.
Who is affected. Siemens SIMATIC IoT2050 devices running Industrial OS with Node-RED installed. The report does not list versions.
What to do. Check whether you run SIMATIC IoT2050 with Node-RED and update to the latest Siemens versions.
When to act. Plan ahead: judged high and no score stated: check the vendor advisory
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: SIMATIC IoT2050 devices are edge gateways that connect plant data to other systems, so they sit between plant and site networks.
- Are you exposed?
Check your asset inventory for SIMATIC IoT2050 devices on Industrial OS and confirm whether Node-RED is installed and reachable over HTTP.
- If you cannot fix it yet
- Restrict access to the Node-RED HTTP interface to known administrator hosts only.
- Block the Node-RED interface at the firewall from the corporate network and the internet.
- Watch for
- Look for unexpected new Node-RED flows or changes to existing flows on IoT2050 devices.
- Look for connections to the Node-RED HTTP interface from unknown hosts.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.