EN PT-BR
← Voltar ao feed
high industrial manufacturing critical infrastructure

CERT-FR: Siemens Desigo CC (Brotli CVE-2026-111497) and SIMATIC IoT2050 Node-RED (CVE-2026-58115) vulnerabilities

1 fonte(s) · 1 atualização(ões) · publicado 04/11/2026 21:00 · coletado há 1 hora

CERT-FR bulletin CERTFR-2026-AVI-1464 (5 November 2026) covers vulnerabilities in Siemens products, based on advisories SSA-045512 and SSA-834709 of 4 November 2026. CERT-FR says they allow remote code execution, denial of service, loss of data confidentiality and integrity, and security policy bypass. The bulletin names two CVEs, CVE-2026-111497 and CVE-2026-58115, and lists Desigo CC V8 and V9 (without the latest .NET patch) and SIMATIC IoT2050 before 4.3.4-1 as affected. According to the Siemens advisories (cert-portal.siemens.com), the first is a Brotli decoder flaw that reaches Desigo CC through .NET, and the second is missing authentication in Node-RED on SIMATIC IoT2050. The CERT-FR bulletin does not mention active exploitation.

Entenda a falha

A vulnerabilidade

CVE-2026-58115 (CVSS 10.0) is missing authentication (CWE-306) in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM. It affects Industrial OS images before V4.3.4-1 with Node-RED installed. A remote, unauthenticated attacker with network reach can create malicious flows and run commands with maximum privileges. CVE-2026-111497 (CVSS v3.1 9.8, v4.0 9.2) is a buffer overflow (CWE-787) in the Brotli decoder, in versions 1.0.3 through 1.2.0. A remote attacker with no authentication or user interaction can send a crafted Brotli stream, causing memory corruption, data leakage, denial of service or potentially code execution. Siemens Desigo CC V8 and V9 are affected through .NET when the latest .NET patch is missing. Fixes: IoT2050 V4.3.4-1 or later; for Brotli, versions 1.0.10, 1.1.1 or 1.2.1, and for Desigo CC the latest .NET updates.

Como funciona

On SIMATIC IoT2050, the Node-RED HTTP interface receives requests from the network. It does not check who is sending them, so an anonymous caller can create flows, and Node-RED runs those flows with maximum privileges, including commands. In the Brotli case, compressed data arrives at the decoder, for example through .NET in Desigo CC. The decoder in c/dec/decode.c processes a crafted stream and writes data outside the memory buffer it should stay within. That corrupts memory and can leak data, crash the service or, potentially, lead to code execution.

Por que é vulnerável

CVE-2026-58115 comes from a missing authentication check (CWE-306) on the Node-RED HTTP interface, which exposes a powerful function, flow creation, to anyone who can reach it. CVE-2026-111497 is an out-of-bounds write (CWE-787) in the Brotli decoder, where a crafted stream makes it write beyond its buffer. The articles do not explain why either went unnoticed or what the code fixes change; they only list the fixed versions. Siemens also suggests uninstalling or hardening Node-RED and restricting network access to the devices as mitigation.

Onde está

CVE-2026-111497 is in the Brotli decoder file c/dec/decode.c; CVE-2026-58115 is in the Node-RED HTTP interface on SIMATIC IoT2050, as described in Siemens advisories SSA-045512 and SSA-834709.

Como foi descoberta

The articles do not say who found either flaw or how. Siemens published advisories SSA-045512 and SSA-834709 on 4 November 2026, and CERT-FR summarized them in bulletin CERTFR-2026-AVI-1464 on 5 November. The CERT-FR bulletin does not mention active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:28.

Detalhes técnicos

  • CVE-2026-111497 (SSA-045512): a buffer overflow (CWE-787) in the Brotli decoder (c/dec/decode.c). A remote, unauthenticated attacker can trigger it with a crafted Brotli stream. It can cause memory corruption, data leakage, denial of service or potentially code execution. CVSS v3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N) and CVSS v4.0 is 9.2. The affected Brotli versions are 1.0.3 through 1.2.0. Desigo CC V8 and V9 are affected through .NET (cert-portal.siemens.com).
  • CVE-2026-58115 (SSA-834709): the Node-RED HTTP interface on SIMATIC IoT2050 Advanced, Basic, M.2 and SM does not enforce authentication (CWE-306). It applies to Industrial OS images before V4.3.4-1 with Node-RED installed. A remote attacker can create malicious flows and run commands with maximum privileges. CVSS v3.1 is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) and CVSS v4.0 is 10.0 (cert-portal.siemens.com).

Remediação

  • Desigo CC V8 and V9: install the latest .NET security updates through Windows Update (cert-portal.siemens.com).
  • Other products that bundle Brotli: update to 1.0.10, 1.1.1 or 1.2.1 (cert-portal.siemens.com).
  • SIMATIC IoT2050: update to V4.3.4-1 or later. As a mitigation, uninstall Node-RED or harden it as described in the Node-RED guide, and restrict network access to the devices (cert-portal.siemens.com).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 04/11/2026 21:00 · coletado 06/11 12:00 primeiro registro

    CERT-FR: Siemens Desigo CC (Brotli CVE-2026-111497) and SIMATIC IoT2050 Node-RED (CVE-2026-58115) vulnerabilities

    ler a análise desta fonte

    CERT-FR bulletin CERTFR-2026-AVI-1464 (5 November 2026) covers vulnerabilities in Siemens products, based on advisories SSA-045512 and SSA-834709 of 4 November 2026. CERT-FR says they allow remote code execution, denial of service, loss of data confidentiality and integrity, and security policy bypass. The bulletin names two CVEs, CVE-2026-111497 and CVE-2026-58115, and lists Desigo CC V8 and V9 (without the latest .NET patch) and SIMATIC IoT2050 before 4.3.4-1 as affected. According to the Siemens advisories (cert-portal.siemens.com), the first is a Brotli decoder flaw that reaches Desigo CC through .NET, and the second is missing authentication in Node-RED on SIMATIC IoT2050. The CERT-FR bulletin does not mention active exploitation.

    Technical Details

    • CVE-2026-111497 (SSA-045512): a buffer overflow (CWE-787) in the Brotli decoder (c/dec/decode.c). A remote, unauthenticated attacker can trigger it with a crafted Brotli stream. It can cause memory corruption, data leakage, denial of service or potentially code execution. CVSS v3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N) and CVSS v4.0 is 9.2. The affected Brotli versions are 1.0.3 through 1.2.0. Desigo CC V8 and V9 are affected through .NET (cert-portal.siemens.com).
    • CVE-2026-58115 (SSA-834709): the Node-RED HTTP interface on SIMATIC IoT2050 Advanced, Basic, M.2 and SM does not enforce authentication (CWE-306). It applies to Industrial OS images before V4.3.4-1 with Node-RED installed. A remote attacker can create malicious flows and run commands with maximum privileges. CVSS v3.1 is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) and CVSS v4.0 is 10.0 (cert-portal.siemens.com).

    Remediation

    • Desigo CC V8 and V9: install the latest .NET security updates through Windows Update (cert-portal.siemens.com).
    • Other products that bundle Brotli: update to 1.0.10, 1.1.1 or 1.2.1 (cert-portal.siemens.com).
    • SIMATIC IoT2050: update to V4.3.4-1 or later. As a mitigation, uninstall Node-RED or harden it as described in the Node-RED guide, and restrict network access to the devices (cert-portal.siemens.com).