Siemens IoT2050 Node-RED Bug Under Active Attack

If you run Node-RED on a Siemens SIMATIC IoT2050, or any box where the editor is reachable without a login, treat this as urgent. VulnCheck says attackers are already using a max-severity flaw to drop Linux bots and leave remote command backdoors.

What happened

In a post dated November 2, VulnCheck researcher Patrick Garrity wrote that one of its canaries caught an exploit for CVE-2026-58115 on October 30. The same source IP then hit that bug 16 times through November 1. The attacker sent a single POST /flows that planted a Node-RED flow, fired an inject node after one second, and ran an exec node that pulled a binary named bot-linux-amd64.

Siemens assigned the CVE earlier. Its SSA-834709 advisory (August 11) says SIMATIC IoT2050 Advanced units running Industrial OS with Node-RED lack authentication on the Node-RED HTTP interface, so an unauthenticated remote attacker can create malicious flows and run code with maximum privileges. The fix is Industrial OS V4.3.4.1 or later. Siemens also tells owners to uninstall Node-RED or harden it (HTTPS, editor/admin auth, auth on HTTP nodes and the dashboard).

VulnCheck later saw staged shell scripts, a second payload host, and flows that expose an HTTP endpoint wired to exec so the attacker can run commands later. It did not retrieve the bot binary, so it makes no claim about what the malware does. The Register and The Hacker News have matching write-ups; @TheHackersNews flagged it on X.

Why it matters

Node-RED is not just a hobby Pi project. Siemens ships it inside industrial edge gear, and VulnCheck notes the same unauthenticated admin pattern shows up on other Node-RED installs. A one-request flow deploy is enough. VulnCheck moved the CVE into its own KEV list; it was not on CISA's KEV when that post went up.

The traffic looks opportunistic, not a surgical strike on one factory. The exploit source sat in Microsoft's AS8075 range and also poked older bugs in Solr, Camunda, Gitea and others. That still leaves every open Node-RED editor on the internet in the blast radius.

What to do

• On IoT2050 Advanced (6ES7647-0BA00-1YA2), update Industrial OS to V4.3.4.1 or newer from Siemens Industry Online Support.
• If you do not need Node-RED, uninstall it. If you do, turn on admin authentication and stop exposing the editor to the public internet.
• Review existing flows for surprise exec nodes or odd HTTP-in paths that look like webshells.
• Keep industrial and home lab gear off the open internet; reach them over a VPN instead. My Tailscale vs WireGuard comparison covers the easy options.