Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

VulnCheck reports active exploitation of a maximum-severity flaw, CVE-2026-58115 (CVSS 10.0), affecting Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. The bug stems from missing authentication on the Node-RED HTTP interface, letting an unauthenticated attacker build malicious flows and execute code with top-level privileges on the device. Since October 30, 2026, VulnCheck's honeypots have captured attackers abusing the flaw to fetch and run a Linux bot binary, later evolving to a two-stage downloader fetching payloads from separate attacker-controlled servers, and in some cases planting a persistent command-execution backdoor via an exposed HTTP endpoint that survives reboots. Siemens patched the issue in version 4.3.4.1 and later, and advises removing Node-RED or hardening it with HTTPS, authentication on the editor/admin API, and secured HTTP nodes and dashboard access.