Covered by 2 outlets — first reported by The Hacker News, Nov 3, 05:34 UTC
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
MentionsSiemens
Summary
Attackers are exploiting a maximum-severity authentication flaw, CVE-2026-58115, rated 10.0 on the CVSS scale, in Siemens SIMATIC IoT2050 Advanced devices, according to VulnCheck. The flaw is a missing authentication check that lets an unauthenticated remote attacker run arbitrary code. VulnCheck says the attacks install a Linux bot and backdoors on unprotected servers running Node-RED, a programming tool built into some industrial products. CISA's KEV catalogue does not list the flaw.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, Help Net Security. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.
Help Net Security
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and backdoors on unprotected servers, VulnCheck has found.
Explained
The technology and terms in this story. Learn more
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.