VulnCheck has confirmed what every industrial security team was dreading. A maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices is now under active exploitation, and the attackers are not just probing. They are deploying working exploits.

The flaw is tracked as CVE-2026-58115, it carries a CVSS score of 10.0, and Siemens published an advisory back in August 2026 describing exactly what goes wrong. SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface.

That missing check lets an unauthenticated remote attacker create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

The Exploitation Details

VulnCheck researcher Patrick Garrity described what the honeypot recorded on October 30, 2026, and the phrase he used is worth quoting directly.

"The attacker's request was a complete exploit. It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding."

That is not a partial attempt. That is a finished weapon.

Here is what the payload did, step by step.

Since that first observation, the operators have adjusted. A two-stage variant now uses wget to retrieve another shell script called wget.sh from the same server.

A separate request was recorded fetching a payload called .sys_update from 45.194.90[.]57:38472. That binary gets saved to /tmp/.kworker, which is a deliberate naming choice. A casual ps check sees something that looks like a kernel worker thread.

Neither wget.sh nor .kworker could be retrieved for analysis, so their exact functionality remains unknown.

The Backdoor That Survives Reboot

One variant of the attack is more concerning than the others, and it does not involve a downloaded binary at all.

"Several requests deployed no downloader at all," Garrity said. "Instead, the flow exposes an HTTP in endpoint, for example /cmd, or a randomly named path, wired through a function node to an exec node with addpay enabled, so the attacker could run arbitrary commands later by passing them in a query parameter."

That is a web shell built inside Node-RED itself. It does not depend on any file on disk. It lives in the flow configuration, which means it survives a reboot even if a memory-backed implant gets wiped.

For defenders, this changes the detection model. You cannot just hunt for dropped binaries. You have to inspect the Node-RED flow configuration itself.

The Fix and the Interim Options

The vulnerability is remediated in Siemens Industrial OS versions 4.3.4.1 and later. That is the only complete fix.

If you cannot patch immediately, Siemens recommends a set of hardening steps.

• Uninstall Node-RED if the device does not need it. This removes the attack surface entirely.
• Enable HTTPS access to the Node-RED interface.
• Secure the editor and admin API with credential-based authentication or through an OAuth or OpenID provider.
• Secure HTTP nodes and the Node-RED Dashboard with basic authentication.

Those measures reduce exposure. They do not replace patching.

What Defenders Should Do Right Now

• Inventory your IoT2050 devices. Identify every SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed. If Node-RED is not required for the operational workflow, remove it.
• Patch to 4.3.4.1 or later. This is the only complete remediation.
• Inspect Node-RED flows directly. Look for HTTP in nodes wired to exec nodes, especially where addpay is enabled. Any flow that accepts a query parameter and pipes it to a shell is a red flag.
• Block the known infrastructure. Add 85.215.73[.]250 and 45.194.90[.]57 to your blocklist and alert on any traffic toward them.
• Hunt for the dropped files. Check /dev/shm for anything named .b and /tmp for files named .kworker or .sys_update. Filenames starting with a dot deserve attention on industrial systems.
• Check for outbound connections from IoT devices. These devices should not be reaching arbitrary external IPs on unusual ports. Egress filtering on industrial segments catches this entire chain.
• Review Node-RED authentication settings. If the editor or admin API is reachable without credentials, that is the exposure path.

Why This One Matters Beyond the Score

A CVSS 10.0 on an industrial device is not the same as a CVSS 10.0 on a web server.

SIMATIC IoT2050 hardware sits in production environments. It connects to control systems, collects telemetry, and often has network reach that ordinary IT assets do not. An attacker with maximum privileges on that device has a foothold inside an operational technology network.

The attack chain here is also unusually clean. No memory corruption. No exploit chain. No user interaction. Just a missing authentication check on an HTTP interface, and a flow that does the rest.

That is the kind of flaw that gets exploited at scale once a working payload circulates, and VulnCheck's honeypot data suggests it already has.

FAQ

What is CVE-2026-58115?

It is a maximum-severity (CVSS 10.0) missing authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. An unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges.

Has this been exploited in the wild?

Yes. VulnCheck observed attackers weaponizing the flaw against its honeypot network on October 30, 2026, deploying a Node-RED flow that downloaded and executed a Linux botnet binary.

Which versions are affected?

SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. The fix is in version 4.3.4.1 or later.

What does the malware do?

The observed payloads fetch a botnet binary from 85.215.73[.]250 and save it to /dev/shm/.b. A two-stage variant pulls wget.sh from the same server, and another fetches .sys_update from 45.194.90[.]57:38472, saving it as /tmp/.kworker.

What is the backdoor variant?

Some attacks deploy no downloader at all. Instead, they create a Node-RED flow that exposes an HTTP endpoint wired to an exec node with addpay enabled. That lets the attacker run arbitrary commands through a query parameter, and it survives a reboot because it lives in the flow configuration.

What should I do if I cannot patch immediately?

Uninstall Node-RED if it is not required, enable HTTPS, secure the editor and admin API with authentication or an OAuth/OpenID provider, and protect HTTP nodes and the dashboard with basic authentication. Then patch as soon as possible.

How do I detect the backdoor variant?

Inspect your Node-RED flow configuration directly. Look for HTTP in nodes connected to function nodes that lead into exec nodes, particularly with addpay enabled. Any flow that accepts a query parameter and passes it to a shell command is a finding.

Source: The Hacker News