Attackers Exploit Maximum-Severity Siemens IoT2050 Flaw to Run Linux Bot Code, VulnCheck Says

A maximum-severity flaw in Siemens industrial gateways is under active attack, and the patch has been available since August.

The vulnerability is tracked as CVE-2026-58115 and carries a CVSS score of 10.0. It affects SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens said in its advisory that the Node-RED HTTP interface lacks authentication, so an unauthenticated remote attacker can create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

Siemens fixed the problem in version 4.3.4.1 and later. For customers who cannot update, the company recommends uninstalling Node-RED or hardening the installation.

What VulnCheck saw

VulnCheck researcher Patrick Garrity said one of the firm's canary systems caught an attacker exploiting the flaw on October 30, 2026. VulnCheck published its advisory Monday, Nov. 2.

Garrity described the first request as a complete exploit. "It didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows," he wrote. The request deployed a Node-RED flow, triggered it automatically and pulled a binary from an attacker-controlled server, all behind three layers of encoding.

Two built-in Node-RED components do the work. An inject node fires a message on a schedule or at startup. An exec node runs shell commands. "Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction," Garrity said.

The payloads

The malicious flow runs a shell script wrapper that uses wget to fetch a botnet binary built for AMD64 from 85.215.73[.]250, with curl as a fallback. The binary is saved as /dev/shm/.b and executed. The file name in the request, bot-linux-amd64, points to a Linux bot. It also suggests the operator may have builds for other architectures.

The attackers have since changed tactics. VulnCheck saw a two-stage version in which wget pulls a second script, wget.sh, from the same server. Another request fetched a payload called .sys_update from 45.194.90[.]57:38472. It saved the file as /tmp/.kworker, a name chosen to look like a harmless kernel worker thread.

VulnCheck could not retrieve wget.sh or .kworker, and it did not fetch the main binary either. "We did not fetch the binary, so we can't say what it does once running," Garrity said. VulnCheck has no telemetry on the download server beyond the URL. Garrity said the separate host suggests a scan-and-infect setup, in which machines that find and exploit vulnerable systems retrieve the implant from a dedicated server.

A backdoor that outlasts a reboot

Several requests dropped no downloader at all. Those flows expose an HTTP-in endpoint, such as /cmd or a randomly named path, wired through a function node to an exec node. That lets the attacker run arbitrary commands later by passing them in a query parameter.

"This backdoor survives even if a memory-backed implant is lost on reboot," Garrity said. Rebooting a compromised gateway would therefore not clear it.

Scattershot, not targeted

The first observed attack came from a single address, 4.201.105[.]116. It sits in Microsoft's AS8075 network and geolocates to Brazil. Between Oct. 30 and Nov. 1, that address hit the Node-RED flaw 16 times. Across VulnCheck's wider canary network it logged 125 hits against eight different CVEs.

One of those targets was CVE-2019-17558, a seven-year-old Apache Solr flaw. The list also covered products including Camunda, Gitea, MLflow, Traefik and Joomla. Garrity said the mix of old and new bugs in unrelated software suggests opportunistic mass scanning rather than a targeted attack.

That cuts two ways. Nobody has said the activity is aimed at a particular industrial operator. But a scanner that fires at everything will find any gateway left unpatched and reachable.

Why OT exposure matters

Node-RED is widely used for workflow automation in industrial control and operational technology environments, and it ships inside commercial products such as the IoT2050 line. The Register noted that criminals are increasingly going after internet-exposed OT and ICS devices, where attacks can reach the physical world. It cited ongoing refrigeration-controller hacks across Europe and attacks on water systems in at least 12 U.S. states over the summer.

None of that has been tied to this campaign. No source has linked the Node-RED exploitation to those incidents.

What to do

The fix is not complicated. Update to Industrial OS version 4.3.4.1 or later. If Node-RED is not needed, uninstall it. If it is, follow Siemens' hardening steps, and do not leave the interface reachable from the internet.

Any gateway that was exposed while unpatched since August deserves a look for unfamiliar flows, especially ones with HTTP-in endpoints wired to exec nodes. Files at /dev/shm/.b or /tmp/.kworker are further signs of compromise.

The open question is scale. VulnCheck has documented attempts against its own canaries from one IP address. It has not said how many real IoT2050 devices are exposed or compromised, and the payloads that would show what the bot does remain unrecovered.