As reported by The Hacker News, a maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices is now under active exploitation, with attackers deploying botnet payloads and persistent backdoors against exposed systems. The flaw, CVE-2026-58115 (CVSS 10.0), stems from missing authentication on the Node-RED HTTP interface in devices running Siemens Industrial OS, allowing unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges.

Security Impact: As reported by The Hacker News, a maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices is now under active exploitation, with attackers deploying botnet payloads and persistent backdoors against exposed systems.

This development is significant not just for its severity rating, but for the speed and sophistication with which threat actors have weaponized it. VulnCheck's honeypot observations reveal a campaign that goes beyond simple crypto-mining opportunism — attackers are establishing durable, reboot-surviving backdoors on industrial edge devices.

Vulnerability Details

FieldDetails
CVE IDCVE-2026-58115
CVSS Score10.0 (Critical)
Vulnerability TypeMissing authentication for critical function (CWE-306)
Affected ProductsSiemens SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed (versions prior to 4.3.4.1)
Patch StatusFixed in version 4.3.4.1 or later
Active ExploitationYes — observed by VulnCheck as of October 30, 2026
Vendor AdvisorySiemens advisory released August 2026

Why This Matters

The attack chain observed by VulnCheck demonstrates a troubling level of operational awareness. Attackers are not merely dropping a payload and moving on — they are creating persistent HTTP endpoint backdoors (e.g., /cmd or randomly named paths) wired through Node-RED function nodes to exec nodes with addpay enabled. This means even if the device reboots and a memory-resident implant is lost, the attacker's command channel survives as long as the malicious flow remains in the Node-RED configuration.

This is a textbook example of living-off-the-orchestration — abusing a legitimate automation platform's own functionality to maintain persistence. Node-RED's design as a visual programming tool makes this attack pattern particularly insidious: the backdoor is just another "flow" in the system, potentially overlooked by operators who may have dozens of legitimate flows running.

The deployment to /dev/shm (a RAM-backed tmpfs) and later to /tmp/.kworker — disguised as a Linux kernel worker thread — shows the attackers understand both Linux internals and operational technology environments where scrutiny of running processes may be lower than in traditional IT.

Who Is at Risk

Why This Matters
Manufacturing and industrial facilities using SIMATIC IoT2050 Advanced devices as edge gateways or data collectors
OT environments where Node-RED is used for protocol translation, data preprocessing, or dashboard visualization
Any deployment where the Node-RED HTTP interface is exposed to the network without authentication — particularly devices internet-facing or accessible from shared corporate network segments

The two-month gap between Siemens' August advisory and observed exploitation in October suggests a window where patched versions were available but many devices remained unpatched. This is a common pattern in OT environments where change windows are restricted and patching cycles are slow.

What You Should Do: Shield53 Recommendations

Immediate Actions

  • Patch now: Upgrade to Industrial OS version 4.3.4.1 or later on all SIMATIC IoT2050 Advanced devices. This is the only permanent fix.
  • If patching is delayed: Uninstall Node-RED entirely from devices where it is not essential to operations.
  • If Node-RED must remain: Implement all Siemens-recommended hardening steps: enable HTTPS, require credential-based authentication or OAuth/OpenID for the editor and admin API, and secure HTTP nodes and the Node-RED dashboard with basic authentication at minimum.
  • Network segmentation: Ensure Node-RED HTTP interfaces are not reachable from untrusted networks. Move IoT2050 devices behind firewalls with strict allow-listing. No Node-RED interface should be internet-facing.

Detection and Response

  • Audit existing flows: Inspect all Node-RED flows on every IoT2050 device for unauthorized or suspicious entries — especially flows containing exec nodes, HTTP input nodes on unexpected paths (e.g., /cmd, randomly named endpoints), or function nodes with encoded/obfuscated content.
  • Check for indicators of compromise: Look for binaries at /dev/shm/.b or /tmp/.kworker, and network connections to 85.215.73[.]250 or 45.194.90[.]57:38472. Block these IPs at perimeter firewalls.
  • Process monitoring: Alert on unexpected wget or curl executions originating from the Node-RED process context, and on any process named .kworker or .sys_update running from /tmp or /dev/shm.
  • Review flow export files: Node-RED flows are stored as JSON. Compare current flow configurations against known-good backups. Any unexplained additions — particularly flows using addpay in exec nodes — should be treated as potential backdoors.

Strategic Recommendations

OT security teams should treat this as a wake-up call for edge device governance. SIMATIC IoT2050 devices are increasingly deployed as flexible IoT gateways, but their configurability is a double-edged sword. Organizations need an inventory of all devices running Node-RED or similar orchestration tools, a baseline of expected flows, and a process for detecting configuration drift. The backdoor pattern observed here — leveraging the platform's own functionality for persistence — will likely be replicated against other automation and orchestration tools in the OT space.

Node-RED's power as a rapid integration tool is precisely what makes it dangerous when left unauthenticated. Every unauthenticated exec node is a remote shell waiting to be discovered.