VulnCheck Observes Attempts to Exploit Critical Siemens IoT2050 Flaw
Summary
VulnCheck observed attempts to exploit CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Linux payloads and Node-RED command backdoors. Siemens fixed the flaw in version 4.3.4.1 or later.
Key points
- CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.
- The flaw could let an unauthenticated remote attacker create malicious flows and execute arbitrary code with maximum privileges.
- As of October 30, 2026, VulnCheck observed attackers attempting to exploit the flaw against its honeypot network.
- Observed flows downloaded and ran Linux payloads, with wget and curl used to retrieve files from 85.215.73[.]250 and 45.194.90[.]57:38472.
- Some flows exposed an HTTP endpoint connected to an execution node, allowing later arbitrary commands through a query parameter; the article says this backdoor can survive the loss of a memory-backed implant on reboot.
- The functionality of the retrieved wget.sh script and .kworker payload remains unknown because researchers could not retrieve them.
- Siemens remediated the issue in version 4.3.4.1 or later and recommends uninstalling Node-RED or hardening its installation.
Article Details
- Vulnerability Types
- Missing authentication for a critical function in the Node-RED HTTP interface
- Severity
- Critical (CVSS 10.0)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Uninstall Node-RED.
- Harden the Node-RED installation following Siemens' advisory steps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 85[.]215[.]73[.]250 | Attacker-controlled server used to deliver a Linux bot binary and later a shell script. |
MITRE ATT&CK
T1059.004 · Unix ShellA shell script wrapper was used to download and execute the payload.T1105 · Ingress Tool TransferThe malicious flow used wget or curl to retrieve a bot binary, shell script, or payload from attacker-controlled servers.T1190 · Exploit Public-Facing ApplicationAttackers exploited the unauthenticated Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices.T1505.003 · Web ShellThe flow could expose an HTTP endpoint wired to an exec node, allowing attackers to run commands through query parameters as a persistent backdoor.
CVE
People
Vendors
Products
Node-RED"SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to createSimatic IoT2050 AdvancedA maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.