A maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced industrial gateways is now being exploited. The vulnerability, CVE-2026-58115 (CVSS 10.0), is a missing-authentication problem in the Node-RED web interface that ships on these devices: an unauthenticated attacker who can reach it can build and deploy a “flow” that runs commands on the underlying system with maximum privileges. Siemens published its advisory and a fix in August 2026. VulnCheck, a vulnerability-intelligence firm, says its honeypot network recorded the first exploitation attempt on October 30.
According to VulnCheck, the attacker sent a single request that created a Node-RED flow, triggered it automatically and used it to download a Linux bot binary from a server the attacker controlled, hiding the commands behind three layers of encoding. The bot was saved as /dev/shm/.b and run from there. VulnCheck has since seen 16 events from the same source IP against this CVE, with several different payloads, including a second download server whose file was saved as /tmp/.kworker to look like a kernel worker process. The Hacker News reports that some requests installed no downloader at all and instead left an HTTP endpoint wired to a command-execution node, giving attackers a backdoor that survives a reboot even if a memory-backed implant is lost. VulnCheck did not retrieve the bot binary or the staged scripts, so what they do is unknown, and it says the scanner’s address in Microsoft’s network range does not identify who is behind it. VulnCheck added the CVE to its own exploited-vulnerabilities catalog; it was not in CISA’s catalog at the time of VulnCheck’s post.
How to check if you’re affected
Affected products are SIMATIC IoT2050 Advanced devices (order number 6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, in all versions before V4.3.4.1, according to Siemens advisory SSA-834709. Update to V4.3.4.1 or later. If you cannot update, Siemens’ listed mitigations are to uninstall Node-RED or harden the installation by following the Node-RED security guide; The Hacker News summarises that as HTTPS access, credential-based or OAuth/OpenID authentication on the editor and admin API, and basic authentication on HTTP nodes and the dashboard.
VulnCheck’s advice goes beyond Siemens hardware: if you run Node-RED anywhere, including inside industrial products, check whether it can be reached from outside your network, and review deployed flows for unexpected exec nodes or HTTP endpoints. Indicators from VulnCheck’s post:
- Payload servers:
85.215.73[.]250(port 8080) and45.194.90[.]57(port 38472) - Dropped files:
/dev/shm/.band/tmp/.kworker - Attack source:
4.201.105[.]116
Sources
- Siemens ProductCERT, SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 Advanced
- VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products
- Node-RED documentation: Securing Node-RED
- The Hacker News: Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors