Attackers exploit Siemens IoT2050 missing authentication flaw
Original title: Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
VulnCheck observed in-the-wild exploitation of CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Node-RED flows that download and run Linux bots.
A missing authentication vulnerability in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS allows unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges. The flaw was remediated in versions 4.3.4.1 or later. As of October 30, 2026 VulnCheck recorded attempts to weaponize the flaw in honeypots, deploying encoded flows that use wget to pull bot binaries from attacker-controlled servers. Some flows expose backdoors for later command execution.
- CVE-2026-58115 CVSS 10.0
- Unauthenticated remote code execution
- Malicious Node-RED flows deployed
- Bot binaries pulled via wget/curl
- Backdoor survives reboots
Impact: arbitrary code execution on underlying server with maximum privileges
| Product | Affected | Fixed in |
|---|---|---|
| Siemens SIMATIC IoT2050 Advanced | running Industrial OS with Node-RED | 4.3.4.1 or later |
- 1.uninstall Node-RED
- 2.enable HTTPS
- 3.secure editor and admin API with credentials or OAuth
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed) | 10.0 | <1% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.194.90.57 | . Another request has been found to run wget/curl against " 45.194.90[.]57:38472 " to fetch a payload called ".sys_update," save it |
| ipv4 | 85.215.73.250 | t to retrieve the botnet binary for AMD64 architecture from 85.215.73[.]250 . Curl is used as a fallback if the wget attempt fails. I |
From the original article
2 min read at thehackernews.com
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10. 0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.