A critical security flaw has been identified in Siemens SIMATIC IoT2050 Advanced devices, posing a significant risk as it is currently being exploited by threat actors. According to VulnCheck, the vulnerability, cataloged as CVE-2026-58115 with a CVSS score of 10.0, arises from the absence of authentication in a crucial function, allowing unauthorized remote attackers to execute arbitrary code.
Details of the Vulnerability
The flaw specifically affects devices running the Industrial OS with Node-RED installed. Siemens has detailed that this missing authentication vulnerability in the Node-RED HTTP interface can let attackers create malicious flows and execute code with full privileges on the server. This issue was highlighted in an advisory by Siemens in August 2026, which also provided remediation guidance.
To mitigate the risk, Siemens advises uninstalling Node-RED or strengthening its installation. Recommended measures include enabling HTTPS for access, securing the editor and admin API using credential-based authentication or OAuth/OpenID, and protecting HTTP Nodes and the Node-RED Dashboard with basic authentication.
Ongoing Exploits and Techniques
As of late October 2026, VulnCheck has observed attempts to exploit CVE-2026-58115 against its honeypot network. Attackers aim to download and execute a Linux bot, with exploit requests deploying a Node-RED flow and automatically triggering downloads from a malicious server.
The exploit involves a multi-layered approach where a shell script wrapper is executed. This script uses wget to fetch a botnet binary for AMD64 systems, with curl as a backup option if wget fails. The binary is then stored as “/dev/shm/.b” and run.
Shifts in Attack Strategy
Recently, attackers have adapted their approach to a two-stage process. The wget command retrieves another shell script dubbed “wget.sh” from the same server. Another observed request attempts to fetch a payload named “.sys_update” from a different server, saving it as “/tmp/.kworker” to disguise it as a legitimate kernel process before execution.
Moreover, some flows expose an HTTP endpoint that, when triggered, allows the execution of arbitrary commands. This backdoor persists even if a memory-resident implant is lost after a reboot, indicating the sophistication and persistence of the attackers’ strategies.
The exact functions of “wget.sh” and “.kworker” remain unclear as they were not retrieved during analysis. However, the ongoing exploitation of this vulnerability underscores the critical need for affected users to apply Siemens’ recommended security measures promptly.
In conclusion, the exploitation of this vulnerability in Siemens IoT2050 devices highlights the importance of robust cybersecurity practices and timely application of software updates to mitigate potential threats.
