A critical security vulnerability affecting Siemens SIMATIC IoT2050 Advanced devices has been actively exploited, according to VulnCheck.
This vulnerability, identified as CVE-2026-58115 (CVSS score: 10.0), involves a lack of authentication for an essential function, which can be leveraged by an unauthenticated remote attacker to execute arbitrary code.
Siemens stated in an advisory issued in August 2026 that “SIMATIC IoT2050 Advanced devices operating on Industrial OS with Node-RED installed have a missing authentication flaw in the Node-RED HTTP interface, enabling an unauthenticated remote attacker to create harmful flows and execute arbitrary code on the underlying server with full privileges.”
The problem has been addressed in versions 4.3.4.1 and later. To mitigate the risk, Siemens advises users to either uninstall Node-RED or enhance the installation by following these steps:
- Enable HTTPS access
- Secure the editor and admin API using credential-based authentication or an OAuth/OpenID provider
- Protect the HTTP Nodes and Node-RED Dashboard with basic authentication
As of October 30, 2026, VulnCheck reported that it had detected attackers trying to exploit CVE-2026-58115 against its honeypot network, aiming to download and execute a Linux bot.
VulnCheck researcher Patrick Garrity noted, “The attacker’s request was a complete exploit. It deployed a Node-RED flow, triggered it automatically, and retrieved a binary from a server controlled by the attacker, all concealed behind three layers of encoding.”
The malicious flow is specifically crafted to execute a shell script wrapper that utilizes wget to download the botnet binary for AMD64 architecture from 85.215.73[.]250. If wget fails, curl is used as a backup. In the final step, the binary is stored as “/dev/shm/.b” and executed.
Subsequently, the attackers involved in this campaign have transitioned to a two-stage method where the wget command is employed to fetch another shell script named “wget.sh” from the same server.
Another request has been identified that runs wget/curl against “45.194.90[.]57:38472” to retrieve a payload called “.sys_update,” which is saved on disk as “/tmp/.kworker” in an effort to disguise it as an innocuous kernel worker thread, and then executed. The precise functions of “wget.sh” or “.kworker” remain unclear, as they could not be accessed.
Garrity remarked, “Several requests did not deploy any downloader at all. Instead, the flow exposes an HTTP endpoint (such as /cmd, or a randomly generated path) connected through a function node to an exec node with addpay enabled, allowing the attacker to execute arbitrary commands later by passing them in a query parameter. This backdoor persists even if a memory-backed implant is lost upon reboot.”
Source: Original article
