Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

VulnCheck has revealed active exploitation of a maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices. The flaw, CVE-2026-58115 with a CVSS score of 10.0, is a missing authentication issue in the Node-RED HTTP interface that can let an unauthenticated remote attacker create malicious flows and execute arbitrary code with maximum privileges. Siemens said the issue was fixed in versions 4.3.4.1 or later.

Vulnerability details

The affected systems are SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens said in an advisory released in August 2026 that the missing authentication vulnerability could allow an unauthenticated remote attacker to run arbitrary code on the underlying server with maximum privileges. As mitigations, Siemens recommends uninstalling Node-RED or hardening the installation by enabling HTTPS access, securing the editor and admin API through credential based authentication or an OAuth/OpenID provider, and securing HTTP Nodes and the Node-RED Dashboard with basic authentication.

Observed exploitation

As of October 30, 2026, VulnCheck said attackers attempted to weaponize CVE-2026-58115 against its honeypot network to download and run a Linux bot. Researcher Patrick Garrity said the attacker's request was a complete exploit that deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server behind three layers of encoding. The malicious flow runs a shell script wrapper that uses wget to retrieve a botnet binary for AMD64 architecture from 85.215.73[.]250, with curl as a fallback if wget fails. The binary is saved as /dev/shm/.b and then executed.

Attackers later switched to a two-stage process in which wget retrieves another shell script named wget.sh from the same server. Another request was found using wget or curl against 45.194.90[.]57:38472 to fetch a payload called .sys_update, save it as /tmp/.kworker in an attempt to disguise it as a harmless kernel worker thread, and then execute it. The exact functionality of wget.sh or .kworker remains unknown because they could not be retrieved.

Some requests deployed no downloader. Instead, the flow exposes an HTTP in endpoint, such as /cmd or a randomly named path, wired through a function node to an exec node with addpay enabled, allowing the attacker to run arbitrary commands later by passing them in a query parameter. This backdoor survives even if a memory-backed implant is lost on reboot.

Sources: The Hacker News