Attackers exploit Siemens IoT2050 flaw to install backdoors

Siemens has warned that its SIMATIC IoT2050 Advanced devices, running Industrial OS with Node-RED, are exposed by a critical vulnerability tracked as CVE-2026-58115 (CVSS 10.0). The flaw is a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to fabricate malicious flows and execute arbitrary code on the underlying server with maximum privileges.

Siemens’ advisory, issued in August 2026, notes that the issue affects devices with Node-RED installed and that remediation is available in version 4.3.4.1 or later. The advisory also recommends hardening Node-RED by enabling HTTPS, instituting credential-based authentication or an OAuth/OpenID provider for the editor and admin API, and securing HTTP Nodes and the Node-RED Dashboard with basic authentication.

VulnCheck researchers reported active exploitation in the wild. As of 30 October 2026, attackers were observed targeting CVE-2026-58115 via a two-stage process: initially using Node-RED to deploy a flow that downloads a Linux bot from an attacker-controlled server, then executing it behind three layers of encoding. The flow can run a shell wrapper that uses wget (with curl as a backup) to fetch a botnet binary for AMD64, saving it to /dev/shm/.b and executing it.

In subsequent activity, attackers attempted to fetch a second script (wget[.]sh) and a payload named .sys_update, saved as /tmp/.kworker, disguising the payload as a kernel worker thread. Some requests point to an exposed HTTP endpoint to pass commands via a query parameter, enabling arbitrary command execution even after reboot. The evidence includes a complete exploit observed on a honeypot network and two-stage download chains described by Patrick Garrity of VulnCheck.