Siemens SIMATIC IoT2050 — Active Exploitation of Node-RED Authentication Flaw Allows Remote Command Backdoors (CVE-2026-58115)

Publication date: November 3, 2026
Category: Vulnerability / Cyber Attack

Introduction

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation in the wild, as revealed by threat intelligence firm VulnCheck. Tracked as CVE-2026-58115, the vulnerability stems from missing authentication controls within the Node-RED HTTP interface when running on Siemens Industrial OS. Malicious actors are weaponizing this exposure to inject malicious flows, download Linux botnet binaries, and establish persistent remote command backdoors across exposed operational environments.

What is CVE-2026-58115? (General Analysis)

The vulnerability designated as CVE-2026-58115 is classified as a missing authentication flaw affecting a critical function (CWE-306: Missing Authentication for Critical Function).

Siemens SIMATIC IoT2050 Advanced devices (6ES7647-0BA00-1YA2) running firmware versions prior to V4.3.4.1 with Industrial OS and Node-RED installed suffer from a dangerous oversight: the Node-RED HTTP interface enforces no authentication by default. This permits any unauthenticated remote attacker to interact directly with programming nodes capable of executing arbitrary system-level commands on the underlying server architecture.

Official NVD Data (Confirmed):

  • CVSS v4.0 Score and Vector: 10.0 (CRITICAL) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • CWE Classification: CWE-306 (Missing Authentication for Critical Function)
  • CISA KEV Catalog: Not currently listed in the catalog.

The resulting risk is comprehensive, compromising confidentiality, integrity, and availability across the targeted gateway and potentially exposing adjacent segments of the industrial control network.

How Does It Work? (Technical Analysis)

The exploitation campaign observed by VulnCheck’s honeypot infrastructure highlights an automated and multi-layered attack chain designed to compromise industrial edge devices:

  • Initial Infection and Flow Deployment: Attackers transmit a fully articulated HTTP exploit request that automatically generates a Node-RED workflow. This payload is heavily obfuscated across multiple encoding layers to bypass basic network inspection tools.
  • Botnet Binary Retrieval and Execution: The injected flow executes a shell wrapper script leveraging wget to retrieve an AMD64 architecture botnet binary from 85.215.73[.]250. If wget encounters an error, curl is invoked as an automatic fallback mechanism. The retrieved binary is subsequently written to the RAM-backed directory /dev/shm/.b and executed immediately.
  • Evolution to Two-Stage Architectures: Threat actors later pivoted to a two-stage process, utilizing wget to fetch a secondary shell script (wget.sh) from the same hosting server. Additional requests were tracked targeting 45.194.90[.]57:38472 to download a payload named .sys_update, saving it to disk as /tmp/.kworker in an attempt to masquerade as a legitimate kernel worker thread prior to execution.
  • Persistent HTTP Command Backdoors: In several captured instances, threat actors omitted downloaders entirely. Instead, the deployed flow exposes an internal HTTP endpoint (such as /cmd or custom randomized paths) mapped through a function node directly to an exec node with addpay enabled. This enables the attacker to pass arbitrary commands via HTTP query parameters at will, ensuring backdoor survival even after system reboots wipe volatile memory implants.

Affected Systems / Environments

The vulnerability directly impacts the following hardware models and software configurations:

CVE CWE Category Impact CVSS Vector (Summary)
CVE-2026-58115 CWE-306 Remote code execution with maximum privileges 10.0 (Critical) AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H
  • Affected Hardware: Siemens SIMATIC IoT2050 Advanced (MLFB: 6ES7647-0BA00-1YA2).
  • Affected Software: All firmware versions prior to V4.3.4.1 running Siemens Industrial OS with Node-RED installed.
  • Risk Profile: Industrial edge computing gateways exposed directly to corporate networks or the public internet without proper perimeter segmentation.

Mitigation and Detection

Remediation

Siemens has released official security advisories and updated firmware packages to address the vulnerability:

  1. Firmware Upgrade: Update SIMATIC IoT2050 Advanced devices to firmware version V4.3.4.1 or later, which enforces mandatory authentication on the Node-RED HTTP interface.
  2. Service Deinstallation: If Node-RED is not operationally required for the industrial process, completely uninstall the package from the system.
  3. Hardening Protocols: If Node-RED must remain active, strictly adhere to hardening guidelines provided by Siemens and the development community:
    • Enforce secure HTTPS access.
    • Secure the editor and admin API using credential-based authentication or an integrated OAuth/OpenID provider.
    • Secure HTTP nodes and the Node-RED Dashboard utilizing basic authentication mechanisms.

Detection

Blue Teams and defenders should actively monitor environments for the following Indicators of Compromise (IoCs) and anomalous behavioral patterns:

  • Unfamiliar outbound network connections originating from IoT gateways toward external IP addresses associated with malware distribution (85.215.73[.]250, 45.194.90[.]57).
  • Unexpected file creation within temporary or memory-backed directories, including /dev/shm/.b, /tmp/.kworker, or unverified shell scripts like wget.sh.
  • Unauthorized Node-RED flows exposing HTTP ingress endpoints (/cmd or randomized URIs) coupled to command execution (exec) nodes.

Defensive Intelligence Insight: “Automated exploitation of the Node-RED interface not only compromises the individual IoT gateway but creates a critical pivoting foothold inside the OT network, allowing adversaries to mask malicious tasks behind legitimate operating system threads.”

Wrapping Up

The active exploitation of CVE-2026-58115 in Siemens SIMATIC IoT2050 Advanced controllers underscores the severe risks tied to unauthenticated programming interfaces in industrial environments. By combining missing access controls with native system execution capabilities, Node-RED becomes a prime target for botnet operators and persistent threat actors alike. Prompt firmware patching, rigorous network segmentation, and strict hardening remain critical countermeasures for defending operational technology infrastructure.

References