Maximum-Severity Siemens IoT2050 Flaw Now Being Used to Plant Backdoors

A maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices is now being actively exploited, according to security firm VulnCheck. Tracked as CVE-2026-58115 (CVSS score: 10.0), the flaw is a missing authentication problem in the Node-RED web interface on devices running Industrial OS. An unauthenticated remote attacker could use it to create malicious flows and run code on the underlying server with the highest privileges. Siemens published an advisory in August 2026 and has fixed the issue in versions 4.3.4.1 and later.

As of October 30, 2026, VulnCheck said it saw attackers trying to exploit the flaw against its honeypot network, with the aim of downloading and running a Linux bot. Researcher Patrick Garrity described the attacker's request as a complete exploit that deployed a flow, triggered it automatically and fetched a binary from an attacker-controlled server, all hidden behind three layers of encoding. The attackers have since moved to a two-stage approach, and another request tried to disguise a downloaded payload as a harmless kernel worker process. VulnCheck could not retrieve some of the files, so their exact functions remain unknown.

For those who cannot update immediately, Siemens recommends either uninstalling Node-RED or hardening the installation using the steps in its advisory.