Attackers are exploiting CVE-2026-58115, a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices. The Hacker News reported the activity on November 3, citing VulnCheck researcher Patrick Garrity.
The flaw scores CVSS 10.0. It is a missing authentication check on a critical function in the Node-RED HTTP interface of devices running Industrial OS. An unauthenticated remote attacker can create malicious Node-RED flows and run arbitrary code with maximum privileges. Siemens published advisory SSA-834709 in August 2026.
As of October 30, VulnCheck observed exploitation attempts against its honeypot network. In the first variant, a malicious flow ran a shell wrapper that used wget, with curl as a fallback, to fetch an AMD64 Linux bot from 85.215.73.250. The binary was saved as /dev/shm/.b and executed. A later stage pulled a second script, wget.sh, from the same server.
A second variant fetched a payload named .sys_update from 45.194.90.57 on port 38472, saved it as /tmp/.kworker and ran it. VulnCheck could not retrieve wget.sh or .kworker, so their functions are unknown. The botnet family was not named.
Some requests deployed no downloader at all. They exposed an HTTP endpoint, such as /cmd or a random path, wired through a function node to an exec node. Attackers could then run commands passed in a query parameter. VulnCheck noted this backdoor survives a reboot that would wipe a memory-resident implant.
Why it matters. IoT2050 units sit in industrial networks. An exposed Node-RED editor gives an attacker code execution, a foothold for lateral movement, and a persistent backdoor that standard malware cleanup can miss.
Mitigation. Update Node-RED to 4.3.4.1 or later. If you cannot patch, uninstall Node-RED or harden it: enable HTTPS, require credential-based or OAuth/OpenID authentication on the editor and admin API, and put basic authentication on HTTP nodes and the Node-RED Dashboard. Do not expose the interface to the internet.
Hunt. Block the two IP addresses above. Search for /dev/shm/.b and /tmp/.kworker. Review Node-RED flows for unexpected HTTP-in, function and exec node chains, especially endpoints that accept a command in a query parameter.
