A critical vulnerability in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited, according to VulnCheck. Tracked as CVE-2026-58115 and assigned a CVSS score of 10.0, the flaw stems from missing authentication in a critical function and could allow a remote attacker to execute code without logging in.
Siemens said the vulnerability affects devices running Industrial OS with Node-RED installed. The unauthenticated Node-RED HTTP interface could be used to create malicious flows and run code on the underlying server with maximum privileges.
The issue is fixed in version 4.3.4.1 and later. Siemens advises users to uninstall Node-RED or secure it by enabling HTTPS, protecting the editor and admin API with credentials or an OAuth/OpenID provider, and enabling basic authentication for HTTP Nodes and the Node-RED Dashboard.
VulnCheck said that on October 30, 2026, it detected attempts to exploit the flaw against its honeypot network and download and run a Linux bot. Researcher Patrick Garrity described one request as a full exploit: it created and automatically triggered a Node-RED flow, then downloaded a binary from an attacker-controlled server. The process used three layers of encoding.
In that attack, the flow ran a shell-script wrapper that used wget to fetch an AMD64 botnet binary from 85.215.73[.]250, with curl as a fallback. The binary was saved as /dev/shm/.b and executed. The attackers later shifted to a two-stage approach, using wget to retrieve another shell script, named wget.sh, from the same server.
VulnCheck also identified a request that used wget or curl to fetch a payload named .sys_update from 45.194.90[.]57:38472. It was set to be saved as /tmp/.kworker, a name intended to resemble a kernel worker process, and then executed. The researchers could not retrieve wget.sh or .kworker, so their precise functions remain unknown.
Some requests did not include a downloader. Instead, they set up a Node-RED HTTP endpoint connected to a function and execution node, allowing the attacker to issue commands through a query parameter. Garrity said this backdoor could remain in place even if a memory-based implant is lost after a reboot.
Sources: The Hacker News.