Attackers Exploit Siemens SIMATIC IoT2050 Node-RED Flaw

TL;DR - Since the last update, Siemens has clarified that SIMATIC IoT2050 Basic, M.2 and SM are also affected, in addition to Advanced, and changed the fixed-version format to V4.3.4-1. - Siemens says all listed SIMATIC IoT2050 products running Industrial OS with Node-RED installed are affected below V4.3.4-1 by CVE-2026-58115. - The missing authentication flaw permits unauthenticated access to Node-RED programming nodes and can enable arbitrary code execution with maximum privileges. - Siemens lists CVSS v3.1 and CVSS v4.0 base scores of 10.0. - VulnCheck reports exploitation involving malicious flows, downloaded Linux payloads and command backdoors.

What happened#

Siemens updated security advisory SSA-834709 on 2026-11-04. The advisory concerns a missing authentication vulnerability in the Node-RED HTTP interface on SIMATIC IoT2050 devices running Industrial OS with Node-RED installed. Siemens identifies the issue as CVE-2026-58115.

The clarified affected-product list includes:

• SIMATIC IoT2050 Advanced, product number 6ES7647-0BA00-1YA2
• SIMATIC IoT2050 Basic, product number 6ES7647-0BA00-0YA2
• SIMATIC IoT2050 M.2, product number 6ES7647-0BB00-1YA2
• SIMATIC IoT2050 SM, product number 6ES7647-0CA00-1AA2

For each product, Siemens lists all versions below V4.3.4-1 running Industrial OS with Node-RED installed as affected. The listed remediation is an update to V4.3.4-1 or later.

Siemens says affected devices do not enforce authentication on the Node-RED HTTP interface. This allows unauthenticated access to programming nodes capable of executing system commands on the server. An unauthenticated remote attacker could create malicious flows through the interface and execute arbitrary code on the underlying server with maximum privileges.

Siemens assigns CVSS v3.1 and CVSS v4.0 base scores of 10.0 and classifies the issue as CWE-306, Missing Authentication for Critical Function.

VulnCheck says that on October 30, 2026, one of its canaries caught an attacker exploiting the vulnerability to deploy a flow that downloaded and ran a Linux bot. The researcher reported 16 events from the same IP against this CVE between October 30 and November 1. The activity included an automatically triggered flow, a three-layer encoded downloader and a binary retrieved from an attacker-controlled server. VulnCheck did not retrieve or analyze the bot binary and made no claims about its capabilities. VulnCheck describes the observed activity.

VulnCheck also reported flows that exposed HTTP endpoints connected through function nodes to exec nodes. Those flows could allow later arbitrary command execution through query parameters. The researcher said some of these backdoors could remain after a memory-backed implant was lost on reboot.

Are you affected#

You may be affected if your organization uses any of the four SIMATIC IoT2050 product lines listed by Siemens, the device runs Industrial OS with Node-RED installed, and its version is earlier than V4.3.4-1.

The relevant Siemens product numbers are 6ES7647-0BA00-1YA2, 6ES7647-0BA00-0YA2, 6ES7647-0BB00-1YA2 and 6ES7647-0CA00-1AA2. Siemens lists V4.3.4-1 or later as the update target for each product. The remediation link is the SIMATIC IoT2050 support page.

Siemens’ updated advisory does not state how many devices are exposed or compromised. VulnCheck’s observations were made against its canary network. The researcher also said that wget.sh and .kworker were not retrieved, so their functionality remains unknown.

What is confirmed and what is reported#

What defenders should do now#

1. Identify SIMATIC IoT2050 Advanced, Basic, M.2 and SM devices in the environment. Record product numbers and versions, and determine whether Industrial OS and Node-RED are installed.

2. Check whether affected devices are running a version below V4.3.4-1. Siemens recommends updating to V4.3.4-1 or later through the SIMATIC IoT2050 support page.

3. If updating is not immediately possible, apply Siemens’ listed mitigations: uninstall Node-RED or harden the Node-RED installation by following the Node-RED User Guide. The Hacker News reports Siemens’ hardening guidance includes enabling HTTPS, protecting the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and protecting HTTP nodes and the Node-RED Dashboard with basic authentication. The Hacker News

4. Review Node-RED flows, revisions, HTTP endpoints, function nodes and exec nodes for unauthorized changes. Pay particular attention to automatically triggered flows, encoded shell commands and HTTP endpoints that pass request parameters to exec nodes.

5. Examine device and network telemetry for unexpected downloads, processes or connections involving 85.215.73[.]250:8080 and 45.194.90[.]57:38472. VulnCheck reported payload references involving bot-linux-amd64, wget.sh and .sys_update, while noting that some files were not retrieved or analyzed.

6. Restrict network access to affected devices. Siemens recommends protecting device network access with appropriate mechanisms and configuring the environment according to its operational guidelines for Industrial Security.

7. Follow Siemens’ general security recommendations and the product manuals while reviewing the device’s security configuration. Siemens provides additional Industrial Security information.

8. If an investigation identifies unauthorized flows, processes or network activity, preserve relevant logs and device data for incident response. The published information does not provide a specific forensic procedure or establish the capabilities of every reported payload.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against Siemens’ guidance for your environment.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: cert-portal.siemens.com
• Research: vulncheck.com
• Report: thehackernews.com