A serious security vulnerability affecting **Siemens SIMATIC IoT2050 Advanced** devices has come under active exploitation. The flaw, identified as **CVE-2026-58115** and boasting a CVSS score of 10.0, stems from missing authentication in a critical function. Security firm **VulnCheck** initially revealed the active exploitation, observing attempts to weaponize the vulnerability against its honeypot network. ## The Vulnerability Explained **Siemens** issued an advisory in August 2026, detailing the issue: "**SIMATIC IoT2050 Advanced** devices running Industrial OS with **Node-RED** installed contain a missing authentication vulnerability in the **Node-RED** HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges."  ## Active Exploitation Observed As of October 30, 2026, **VulnCheck** researchers documented attackers leveraging **CVE-2026-58115** to download and execute a Linux bot. **VulnCheck** researcher Patrick Garrity noted, "The attacker's request was a complete exploit. It deployed a **Node-RED** flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding." The malicious flow is designed to run a shell script that utilizes `wget` (with `curl` as a fallback) to retrieve a botnet binary for AMD64 architecture from `85.215.73[.]250`. The binary is then saved as `/dev/shm/.b` and executed.  ## Evolving Attack Methods Attackers have since evolved their tactics. Some campaigns now employ a two-stage process, using `wget` to fetch another shell script (`wget.sh`) from the same server. Other observed requests involve fetching a payload named `.sys_update` from `45.194.90[.]57:38472`, saving it as `/tmp/.kworker` to mimic a harmless kernel worker thread, and then executing it. The precise functions of `wget.sh` and `.kworker` remain undetermined. Garrity also highlighted instances where attackers deployed no immediate downloader. Instead, they configured a **Node-RED** flow to expose an HTTP endpoint (e.g., `/cmd`) wired through a function node to an `exec` node with `addpay` enabled. This backdoor allows attackers to run arbitrary commands later by passing them as query parameters, providing persistence even if memory-backed implants are lost upon reboot. ## Remediation and Mitigations **Siemens** has remediated the issue in versions 4.3.4.1 or later. For users unable to update immediately, **Siemens** recommends uninstalling **Node-RED** or hardening the installation by: * Enabling HTTPS access. * Securing the editor and admin API via credential-based authentication or an OAuth/OpenID provider. * Securing HTTP Nodes and **Node-RED Dashboard** using basic authentication.