A top-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited in the wild, according to VulnCheck.

Tracked as CVE-2026-58115 with a CVSS score of 10.0, the flaw is a missing authentication issue in the Node-RED HTTP interface that lets an unauthenticated remote attacker create malicious flows and run arbitrary code on the underlying server with maximum privileges, Siemens said in an August 2026 advisory. The company has fixed the problem in version 4.3.4.1 and later, and recommends uninstalling Node-RED or hardening the installation with HTTPS, credential-based or OAuth/OpenID authentication for the editor and admin API, and basic authentication for HTTP nodes and the dashboard.

As of October 30, 2026, VulnCheck reported attackers targeting its honeypot network to download and run a Linux bot. Researcher Patrick Garrity described the request as a complete exploit: it deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server behind three layers of encoding. The flow ran a shell script wrapper that used wget, with curl as a fallback, to fetch an AMD64 botnet binary from 85.215.73[.]250, saving and executing it as /dev/shm/.b.

Attackers later shifted to a two-stage process, using wget to retrieve another shell script called wget.sh from the same server. Another request was seen fetching a payload named .sys_update from 45.194.90[.]57:38472, saving it as /tmp/.kworker to mimic a kernel worker thread before execution. The functionality of wget.sh and .kworker remains unknown because they could not be retrieved.

Some requests skipped downloaders entirely, exposing an HTTP-in endpoint wired through a function node to an exec node with addpay enabled, allowing arbitrary commands to be passed later via a query parameter. Garrity noted that this backdoor survives even if a memory-backed implant is lost on reboot.

Source: The Hackers News