Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
Vulnerabilities in Siemens SIMATIC IoT2050 Advanced devices with Industrial OS and Node-RED installed have been actively exploited by attackers, according to the cybersecurity firm VulnCheck. The flaw, CVE-2026-58115, stems from a missing authentication vulnerability in the Node-RED HTTP interface. This enables unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges on the underlying server.
Siemens acknowledged the issue in an advisory released in August 2026 and recommends users uninstall Node-RED or harden installations by following specific mitigation steps. As of October 30, 2026, VulnCheck observed attackers weaponizing the vulnerability, deploying a Node-RED flow, triggering it automatically, and pulling a Linux bot from an attacker-controlled server.
The malicious flow, designed in three layers of encoding, pulls a binary for AMD64 architecture, executes it, and saves it as /dev/shm/.b for execution. Later, the attackers switched to a two-stage process, using wget to retrieve another shell script, save it as /tmp/.kworker, and execute it. The backdoor persists even after a reboot, as it is not tied to a memory-backed implant.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
