Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors Ravie LakshmananNov 03, 2026Vulnerability / Cyber Attack A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges," Siemens said in an advisory released back in August 2026. The issue has been remediated in versions 4.3.4.1 or later. As mitigations, Siemens recommends that users uninstall Node-RED or harden the installation by following the steps below - Securing the editor and admin API via credential based authentication or through an OAuth/OpenID provider Securing the HTTP Nodes and Node-RED Dashboard using basic authentication As of October 30, 2026, VulnCheck said it observed attackers attempting to weaponize CVE-2026-58115 against its honeypot network in an attempt to download and run a Linux bot. "The attacker's request was a complete exploit," VulnCheck researcher Patrick Garrity said. "It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding." Specifically, the malicious flow is designed to run a shell script wrapper, which uses wget to retrieve the botnet binary for AMD64 architecture from 85.215.73[.]250. Curl is used as a fallback if the wget attempt fails. In the final stage, the binary is saved as "/dev/shm/.b" and executed. Since then, the attackers behind the campaign have switched to a two-stage process where the wget command is used to retrieve another shell script ("wget.sh") from the same server. Another request has been found to run wget/curl against "45.194.90[.]57:38472" to fetch a payload called ".sys_update," save it on disk as "/tmp/.kworker" in an attempt to disguise it as a harmless kernel worker thread," and then execute it. The exact functionality of "wget.sh" or ".kworker" remains unknown, as they could not be retrieved. "Several requests deployed no downloader at all. Instead, the flow exposes an HTTP in endpoint (for example /cmd, or a randomly named path) wired through a function node to an exec node with addpay enabled, so the attacker could run arbitrary commands later by passing them in a query parameter," Garrity said. "This backdoor survives even if a memory-backed implant is lost on reboot." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, Industrial Security, Internet of Things, Malware, Vulnerability AI-Generated Fake Login Pages Are Making Account Takeovers Easier PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security