Siemens SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)

CheckOps priority index

5.2/10 Patch within 7 days

Severity10.0

Probability0.1

Exploitation2/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 0.89% higher than 59.5% of CVEs

CVSS 4.0 10.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/

Exploited for 2 days 03 Nov 2026

Fixed packages 0 / 0 in open source registries

Exploitation probability EPSS · FIRST

The EPSS history of this vulnerability is building up: the chart will appear in a few days.

Exploitation signals 2 / 5

KEV catalog (CISA)no
Exploited in EUVD (ENISA)03 Nov 2026
Used by ransomwareno
EPSS above 10 %0.89%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

Affected products

SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)

Affected versions

0 <V4.3.4-1

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

11 Aug 2026
Published
03 Nov 2026
Exploitation reported (ENISA)

References

Other exploited vulnerabilities from the same vendor

CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element Vulnerability
4.6 · Rising fast
CVE-2016-8562Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
4.3 · Background exploitation