{
  "id": 17915199,
  "title": "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors",
  "url": "https://urgent.news/2026/11/03/attackers-exploit-critical-siemens-iot2050-flaw-to-plant-remote",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T05:34:41.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html"
  },
  "original_language": "en",
  "account": "Vulnerabilities in Siemens SIMATIC IoT2050 Advanced devices with Industrial OS and Node-RED installed have been actively exploited by attackers, according to the cybersecurity firm VulnCheck. The flaw, CVE-2026-58115, stems from a missing authentication vulnerability in the Node-RED HTTP interface. This enables unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges on the underlying server. Siemens acknowledged the issue in an advisory released in August 2026 and recommends users uninstall Node-RED or harden installations by following specific mitigation steps. As of October 30, 2026, VulnCheck observed attackers weaponizing the vulnerability, deploying a Node-RED flow, triggering it automatically, and pulling a Linux bot from an attacker-controlled server. The malicious flow, designed in three layers of encoding, pulls a binary for AMD64 architecture, executes it, and saves it as /dev/shm/.b for execution. Later, the attackers switched to a two-stage process, using wget to retrieve another shell script, save it as /tmp/.kworker, and execute it. The backdoor persists even after a reboot, as it is not tied to a memory-backed implant.",
  "summary": "A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. \"SIMATIC IoT2050 Advanced devices running",
  "key_points": [
    "Critical Siemens IoT2050 flaw exploited by attackers",
    "CVE-2026-58115 vulnerability stems from missing authentication in Node-RED HTTP interface",
    "Attackers plant remote command backdoors, persisting after reboot"
  ],
  "editors_take": "Exploiting authentication gaps in industrial interfaces transforms standard IoT hardware into persistent backdoors, allowing remote attackers to bypass security layers and maintain long-term control over critical server environments.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}