A maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices (CVE-2026-58115) has been observed actively exploited in the wild. The flaw, which carries a rare 10.0 CVSS score, allows unauthenticated remote attackers to run arbitrary code via the Node-RED HTTP interface on Industrial OS, giving full control over affected systems.
What’s at Risk
The issue stems from missing authentication controls in Node-RED’s HTTP endpoint. Devices running Industrial OS with Node-RED exposed are vulnerable to flows crafted by attackers to execute commands with maximum privileges on the underlying system. Siemens issued a fix in firmware version 4.3.4.1, but older versions remain at risk.
How the Exploit Works
Threat monitoring from VulnCheck shows abuse of CVE-2026-58115: attackers deploy a flow that triggers automatically, downloads a Linux bot binary (for AMD64 architecture) using wget or curl from attacker-controlled servers, writes it to memory or temporary storage under obfuscated names (e.g. “/dev/shm/.b”), and executes it.
More recent campaigns take a two-stage path: first fetching a shell script named “wget.sh”, followed by a payload dubbed “.sys_update”, saved as “/tmp/.kworker” to masquerade as a kernel process. These stages also include backdoors that survive reboot by injecting endpoints (e.g. “/cmd” or random paths) tied to function nodes, allowing execution of arbitrary commands via query parameters.
Mitigation Strategies
Siemens’ advisory recommends upgrading to version 4.3.4.1 or later as the definitive fix. Other steps include uninstalling Node-RED entirely where possible, enforcing HTTPS, adding credential-based or OAuth/OpenID authentication for editor/admin APIs, and securing HTTP nodes and dashboards with basic authentication.
Why It Matters
This isn’t simply another IoT bug: it represents direct remote access without needing credentials, targeting systems used in industrial and critical infrastructure settings. Backdoors of this nature grant persistent control, enabling data theft, sabotage, or integration into botnets—at scale.
Siemens devices are used in manufacturing, utilities, and other industrial settings where operations depend on reliability and safety. An attacker gaining root-level access via an IoT edge controller can affect upstream processes and downstream controls. As threats targeting OT (Operational Technology) environments continue to rise, this kind of mis-authentication vulnerability under Node-RED highlights the need for defense in depth.
Takeaway: If your systems use SIMATIC IoT2050 Advanced with Node-RED, immediately apply firmware 4.3.4.1 or later. Audit and lock down exposed interfaces. Going without this fix leaves open doors for attackers seeking elevated privileges, enduring backdoors, and wide-scale operational disruptions.
Moving forward, the sector needs to monitor whether attackers expand this campaign—even into older or alternate industrial OS variations. Stakeholders should also demand stricter, zero-trust design for network services in OT devices, especially ones meant for remote workflows or cloud integration.
