CVE-2026-58115: attackers are probing Siemens IoT2050 gateways through Node-RED, but no real device is confirmed hacked

What the flaw is

The SIMATIC IoT2050a small industrial computer from Siemens used as a gateway between factory machines and IT systems, often to collect sensor data can run Node-REDan open-source tool for building automations by connecting blocks, called nodes, in a browser. According to Siemens' advisory SSA-834709, the Node-RED HTTP interface on these devices does not enforce authentication. Some Node-RED blocks can run system commands, so an attacker who reaches the interface can create a malicious "flow" and execute code on the device "with maximum privileges".

Siemens first published the advisory on August 11, 2026 with a fix in version V4.3.4-1. On November 4 it updated the advisory to clarify the affected products. The list now names four models: IoT2050 Advanced, Basic, M.2 and SM.

What was actually observed

The reports of attacks come from VulnCheck, a vulnerability intelligence company. In a post published on November 2, it says one of its canariesdecoy systems built to look like a real vulnerable device, so researchers can watch what attackers do caught an attacker exploiting CVE-2026-58115 on October 30. The attacker sent a single request that installed a flow to download and run a Linux program called bot-linux-amd64. VulnCheck did not analyze that program, so what it does is unknown.

VulnCheck counted 16 events from the same IP address against this flaw between October 30 and November 1. Some requests installed no program at all and instead added a web endpoint connected to a command node, a webshella hidden web address that lets an attacker send commands to a server whenever they want. VulnCheck notes that this kind of backdoor "survives even if a memory-backed implant is lost on reboot".

The same address hit eight different CVEs in a few days, including flaws in Apache Solr, Gitea, MLflow and Joomla. VulnCheck reads this as opportunistic scanning, not an operation aimed at Siemens customers.

What headlines get wrong

Several outlets reported that hackers are exploiting the flaw to install backdoors on Siemens devices. The attacks are real, but they hit VulnCheck's decoys. VulnCheck does not report the compromise of any real Siemens device. CISA has not added CVE-2026-58115 to its Known Exploited Vulnerabilities catalog, and when the CVE was published in August, CISA's assessment listed its exploitation as "none". VulnCheck has added it to its own exploited-vulnerabilities list.

The practical meaning is still serious. Automated attacks against exposed Node-RED interfaces are happening now, and an IoT2050 reachable from the internet without a login would be an easy target.

What to do

1. Update the IoT2050 to V4.3.4-1 or later, as Siemens recommends.
2. If you cannot update yet, follow Siemens' two mitigations: harden Node-RED, for example by turning on its adminAuth login, or uninstall Node-RED if you do not use it.
3. Check whether the Node-RED interface can be reached from outside your network today. Industrial devices should sit behind a firewall or VPN, as Siemens' general security guidance says.
4. Look at the flows already deployed. Unknown exec nodes, new HTTP endpoints or files such as /dev/shm/.b and /tmp/.kworker are signs that someone got in. Patching does not remove a flow an attacker already added.

Still unknown

We do not know how many IoT2050 devices are exposed online, whether any real one has been hacked, or who runs the attacking server. We will update this analysis if Siemens, CISA or VulnCheck publish more.

For other flaws used against internet-facing equipment this autumn, see the Ivanti Connect Secure attacks and the CISA list for October 26 to 29, which includes a Cisco firewall VPN flaw.