Siemens IoT2050 Node-RED Flaw Exploited by Botnet

Attackers are exploiting CVE-2026-58115, a maximum-severity missing-authentication flaw in the Node-RED interface on Siemens SIMATIC IoT2050 Advanced devices. Siemens shipped a fix in August 2026, so the job is simple: upgrade, or take Node-RED off the device.

What changed

The Hacker News reports that VulnCheck observed exploitation attempts against its honeypot network as of October 30, 2026. The attempts tried to download and run a Linux bot. VulnCheck researcher Patrick Garrity called the observed request “a complete exploit.”

Siemens rates the flaw CVSS 10.0. Per its advisory, devices running Industrial OS with Node-RED installed let an unauthenticated remote attacker execute arbitrary code with maximum privileges through the Node-RED HTTP interface.

What to do

• Upgrade. Siemens says the issue is fixed in version 4.3.4.1 or later.
• If you can’t upgrade, remove Node-RED. Siemens lists uninstalling it as a mitigation.
• Otherwise harden it. Siemens recommends enabling HTTPS, securing the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and protecting HTTP nodes and the Node-RED Dashboard with basic authentication.
• Keep the editor off the internet. Anything reachable from outside your control network is the first thing to fix.

Check for compromise

Patching does not remove a foothold. VulnCheck reports that some requests installed no downloader. They left a persistent HTTP endpoint wired to command execution, which survives a reboot even if a memory-backed implant is lost. A device patched after October 30 can still carry that backdoor.

Review deployed Node-RED flows for ones you did not create, including any that expose an HTTP input. Also look for the file paths and hosts VulnCheck published:

• /dev/shm/.b and /tmp/.kworker
• outbound connections to 85.215.73[.]250 and 45.194.90[.]57

VulnCheck could not retrieve the follow-on scripts, so what the payloads do beyond acting as a bot is unknown.

Priority call

Patch this one ahead of routine OT maintenance. The advisory is months old, a working exploit is in use, and the persistence method means late patching is not enough. We have not seen CISA list it as exploited, so we make no KEV claim here. Check the KEV hub for updates.

Related coverage: Siemens Software Center Flaw Abused in ClickFix Campaign and New Mexico Hospital Diverts Ambulances in Cyber Incident. More in the ICS/OT hub.