Critical Siemens IoT2050 Vulnerability Exploited in Real-World Attacks (CVE-2026-58115)

A critical security vulnerability affecting Siemens industrial IoT gateways is now being exploited by attackers, who are using the flaw to deploy Linux malware and webshells onto vulnerable systems.

The vulnerability, tracked as CVE-2026-58115, carries the maximum CVSS severity score of 10.0 and affects Siemens SIMATIC IoT2050 devices running Industrial OS with Node-RED installed.

The security issue allows unauthenticated remote attackers to access the Node-RED HTTP interface and exploit programming features capable of executing system commands. This could give attackers complete control over vulnerable devices without requiring a username, password or user interaction.

Node-RED is a flow-based programming environment commonly used to connect hardware, APIs and online services. It is also deployed in industrial control systems (ICS), operational technology (OT) environments and industrial automation applications.

Attacks observed in October

Security researchers at VulnCheck detected active exploitation of the vulnerability on 30 October 2026.

The initial attack involved a malicious Node-RED flow designed to execute automatically and download a Linux-based bot from an attacker-controlled server. The payload was concealed behind multiple layers of encoding to make analysis more difficult.

Researchers subsequently recorded another 15 attacks from the same IP address by 1 November. These additional attempts included the deployment of persistent webshells, potentially allowing attackers to execute commands remotely on compromised systems.

The activity suggests attackers are scanning the internet for exposed Node-RED installations that lack authentication and attempting to compromise them automatically.

Security researchers have warned that the vulnerability is particularly concerning because Node-RED is frequently deployed in industrial environments, where compromised systems could potentially provide attackers with access to wider operational technology networks.

Which devices are affected?

According to Siemens, the following SIMATIC IoT2050 products are affected when running Industrial OS with Node-RED installed:

• SIMATIC IoT2050 Advanced
• SIMATIC IoT2050 Basic
• SIMATIC IoT2050 M.2
• SIMATIC IoT2050 SM

All versions earlier than V4.3.4-1 are affected.

The vulnerability is classified as CWE-306, relating to missing authentication for a critical function. Both CVSS 3.1 and CVSS 4.0 assign it a maximum severity score of 10.0.

Mitigation and security recommendations

Siemens has released updated software to address the vulnerability and recommends that customers upgrade affected devices to version V4.3.4-1 or later.

Where immediate updating is not possible, Siemens recommends:

• Uninstalling Node-RED if it is not required.
• Hardening Node-RED installations using the official security guidance.
• Restricting network access to SIMATIC IoT2050 devices.
• Ensuring industrial systems are protected behind appropriate network security controls.

Organisations should also inspect existing Node-RED flows for unexpected execution nodes, suspicious HTTP endpoints and other unauthorised modifications.

With exploitation now confirmed in the wild, organisations operating Siemens IoT2050 hardware should treat the vulnerability as a high-priority security issue rather than waiting for routine maintenance windows.

Further information

• Siemens Security Advisory SSA-834709
• SecurityWeek – Critical Node-RED Flaw Exploited in Attacks
• Tenable – CVE-2026-58115