Attackers exploit Siemens IoT2050 flaw to run remote commands

How the flaw works

A serious security flaw, tracked as CVE-2026-58115, affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. According to The Hacker News↗ (opens in a new tab), the vulnerability is due to missing authentication in the Node-RED HTTP interface. This means anyone on the network, without a password or other checks, can access a critical part of the system. An attacker can use this to create malicious flows, custom scripts that automate tasks inside Node-RED, and run any code they want on the device, with the highest level of access.

How the attack worked

Researchers at VulnCheck observed attackers using this flaw in real-world attacks. The attackers sent specially crafted requests to the vulnerable devices. These requests deployed a Node-RED flow that automatically downloaded and ran a program from an attacker-controlled server. The payload was hidden behind several layers of encoding, making it harder to spot. The main script used wget to fetch a Linux botnet binary for AMD64 systems from a specific IP address. If wget failed, it would try again with curl. The binary was saved in a temporary directory and executed.

Attackers later changed tactics, switching to a two-stage process. Instead of downloading the botnet directly, the first script would fetch another shell script, which then downloaded the final payload. In some cases, the attackers set up a backdoor by exposing a new HTTP endpoint on the device. This allowed them to send commands remotely at any time, even after a reboot, as long as the backdoor flow remained.

Is there a fix?

Siemens released a fix for this vulnerability in August 2026. The issue is resolved in Industrial OS versions 4.3.4.1 or later. Siemens recommends uninstalling Node-RED if it is not needed. If Node-RED must be used, Siemens advises securing the editor and admin API with credentials or an OAuth/OpenID provider, and protecting HTTP nodes and dashboards with basic authentication. These steps help prevent unauthorised access to the Node-RED interface.

What you should do

If you manage Siemens SIMATIC IoT2050 Advanced devices, check your version of Industrial OS and update to at least 4.3.4.1. Remove Node-RED if you do not use it. If you need Node-RED, follow Siemens' guidance to secure all interfaces with strong authentication. Monitor your devices for unusual network traffic or new HTTP endpoints that could indicate compromise.

So far, only The Hacker News has reported on these attacks, citing VulnCheck's findings. There is no confirmation yet from Siemens or a government agency. The exact purpose of some payloads used by attackers remains unknown, as they could not be retrieved for analysis.