Attackers Exploit Siemens IoT2050 Flaw to Install Persistent Backdoors
Attackers have been exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices since at least October 30, VulnCheck reported after observing attempts against its honeypot network. The flaw, tracked as CVE-2026-58115, allows an unauthenticated remote attacker to run arbitrary code when Node-RED is installed.
Siemens said in an August 2026 advisory that the vulnerable devices run Industrial OS and contain missing authentication in the Node-RED HTTP interface. An attacker can use that interface to create malicious flows, which are automated workflows, and execute code on the underlying server with maximum privileges.
The issue is fixed in version 4.3.4.1 or later, according to Siemens. The company recommends uninstalling Node-RED or protecting its editor and administration API with credential-based authentication or an OAuth/OpenID provider. Siemens also recommends basic authentication for the HTTP Nodes and Node-RED Dashboard.
VulnCheck researcher Patrick Garrity said one observed exploit deployed a Node-RED flow, triggered it automatically and downloaded a Linux bot. Other requests fetched shell scripts or payloads and executed them on the device. VulnCheck said some flows instead created HTTP endpoints connected to command-execution functions, allowing attackers to run commands through later requests.
VulnCheck said the command-execution backdoor can survive the loss of a memory-backed implant after a reboot. The researchers could not retrieve the functionality of the payloads named wget.sh and .kworker, so the evidence does not establish what those components do.