Active attacks target Siemens SIMATIC IoT2050 Node-RED flaw

Critical Siemens IoT2050 flaw is under active exploitation

Attackers are actively exploiting CVE-2026-58115, a maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices, to install malware and create remote command backdoors. The flaw has a CVSS score of 10.0 and affects devices running Industrial OS with Node-RED installed.

VulnCheck observed exploitation attempts against its honeypot network on October 30, 2026. The activity used the vulnerable Node-RED HTTP interface to deploy a malicious flow, trigger it, and retrieve a Linux botnet binary from attacker-controlled infrastructure.

Siemens described the weakness in its August 2026 advisory as missing authentication for a critical function. An unauthenticated remote attacker can create malicious Node-RED flows and execute arbitrary code on the underlying server with maximum privileges.

Malicious flows download payloads or retain command access

In one observed chain, the malicious flow ran a shell-script wrapper that used wget to download an AMD64 botnet binary from 85.215.73[.]250. Curl served as a fallback when wget failed. The downloaded file was written to /dev/shm/.b and then executed.

VulnCheck also identified a later two-stage approach in which wget retrieved a shell script named wget.sh from the same server. A separate request used wget or curl to fetch a payload named .sys_update from 45.194.90[.]57:38472, save it as /tmp/.kworker, and execute it. The functionality of wget.sh and .kworker could not be determined because the files were unavailable for retrieval.

Not every observed request used a downloader. Some flows exposed an HTTP input endpoint, such as /cmd or a randomly generated path, then passed a query parameter through a function node to an exec node with addpay enabled. This arrangement allows an attacker to issue arbitrary commands later through the endpoint.

VulnCheck noted that this command backdoor can remain available even when a memory-backed implant disappears after a reboot, because the deployed Node-RED flow persists. That makes incident response dependent on checking configured flows as well as looking for transient processes and downloaded binaries.

Update and restrict Node-RED access

Siemens remediated CVE-2026-58115 in version 4.3.4.1 and later. Its mitigations include uninstalling Node-RED where it is not needed, enabling HTTPS, protecting the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and applying basic authentication to HTTP Nodes and the Node-RED Dashboard.

For businesses operating affected industrial devices, the practical priority is to identify SIMATIC IoT2050 Advanced systems with Node-RED, move them to the fixed release, and verify that any retained web interfaces are authenticated and reviewed for unapproved flows or command endpoints.