Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.

The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.

"SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges," Siemens said in an advisory released back in August 2026.

The issue has been remediated in versions 4.3.4.1 or later. As mitigations, Siemens recommends that users uninstall Node-RED or harden the installation by following the steps below -

• Enabling HTTPS access

• Securing the editor and admin API via credential based authentication or through an OAuth/OpenID provider

• Securing the HTTP Nodes and Node-RED Dashboard using basic authentication

As of October 30, 2026, VulnCheck said it observed attackers attempting to weaponize CVE-2026-58115 against its honeypot network in an attempt to download and run a Linux bot.

"The attacker's request was a complete exploit," VulnCheck researcher Patrick Garrity said. "It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding."

Specifically, the malicious flow is designed to run a shell script wrapper, which uses wget to retrieve the botnet binary for AMD64 architecture from 85.215.73[.]250. Curl is used as a fallback if the wget attempt fails. In the final stage, the binary is saved as "/dev/shm/.b" and executed.

Since then, the attackers behind the campaign have switched to a two-stage process where the wget command is used to retrieve another shell script ("wget.sh") from the same server.

Another request has been found to run wget/curl against "45.194.90[.]57:38472" to fetch a payload called ".sys_update," save it on disk as "/tmp/.kworker" in an attempt to disguise it as a harmless kernel worker thread," and then execute it. The exact functionality of "wget.sh" or ".kworker" remains unknown, as they could not be retrieved.

"Several requests deployed no downloader at all. Instead, the flow exposes an HTTP in endpoint (for example /cmd, or a randomly named path) wired through a function node to an exec node with addpay enabled, so the attacker could run arbitrary commands later by passing them in a query parameter," Garrity said. "This backdoor survives even if a memory-backed implant is lost on reboot."