Cybersecurity
Attackers exploit Siemens IoT2050 flaw
VulnCheck said it saw exploitation of CVE-2026-58115 against honeypots using Siemens SIMATIC IoT2050 Advanced devices, while Siemens had already issued a fix and mitigation steps for affected Node-RED installations.
- VulnCheck said it observed attackers trying to use CVE-2026-58115 against its honeypot network by 30 October 2026.
- Siemens had said the flaw affected SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.
- Siemens said versions 4.3.4.1 or later fixed the issue and recommended uninstalling Node-RED or hardening the setup.
- Patrick Garrity said one attack deployed a Node-RED flow, triggered it and fetched a binary from 85.215.73[.]250.
- VulnCheck said later requests used a second-stage script and another server to fetch payloads disguised as system files.
VulnCheck said it had seen attempts to exploit CVE-2026-58115 against its honeypot network by 30 October 2026. It said the goal was to download and run a Linux bot.
Siemens had described the flaw in August 2026 as a missing-authentication problem in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running Industrial OS. The company said an unauthorised remote attacker could create malicious flows and execute code, and that version 4.3.4.1 or later fixed it.
Patrick Garrity of VulnCheck said one request deployed a Node-RED flow, ran it automatically and pulled a binary from 85.215.73[.]250. He said wget was used first, with curl as a fallback, and that the file was written to /dev/shm/.b before execution.
VulnCheck said the attackers later shifted to a second-stage approach that fetched a shell script from the same server. It also said another request targeted 45.194.90[.]57:38472 to retrieve a payload saved as /tmp/.kworker, though it said the script’s exact purpose was still unknown.
Garrity said some requests did not use a downloader at all. Instead, he said, they exposed an HTTP endpoint wired to an exec node, which would let an attacker send commands later through a query parameter.
Named in this story
People
- Patrick Garrity
- the VulnCheck researcher who described the activity
Companies
- Siemens
- issued the advisory and provided the fix
- VulnCheck
- said it observed exploitation attempts
Products and systems
- SIMATIC IoT2050 Advanced devices
- the affected device line
- Industrial OS
- the operating system on the affected devices
- Node-RED
- the installed component with the vulnerable HTTP interface
- CVE-2026-58115
- the tracked vulnerability
How the source tells it
A security-alert register that leans on severity labels, exploit language and time-stamped observations to create urgency.
- alarm loaded severity wording and repeated references to remote code execution
- urgency active-exploitation framing and mitigation advice tied to a dated observation