Skip to content
securitytabs

LiveUpdated

Attackers exploit maximum-severity flaw in Siemens IoT2050 devices

Attackers are breaking into some Siemens industrial devices that run a programming tool called Node-RED, without needing a password, and installing remote-control software. Organizations using these devices should check now whether they are exposed.

Siemens IoT2050 login bypass exploited in attacks
Siemens IoT2050 login bypass exploited in attacks

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

VulnCheck says attackers are actively exploiting CVE-2026-58115, a missing-authentication flaw affecting Siemens SIMATIC IoT2050 Advanced devices. A remote attacker with no credentials could use it to run arbitrary code on the device. NVD rates it 10.0 on the CVSS v4.0 scale. [1][2]

Siemens has published a security advisory for the flaw. The SANS Internet Storm Center also flagged the active exploitation on 4 November. [1][3]

Exploitation

VulnCheck says attackers are using the flaw to install a Linux bot and backdoors on unprotected servers. Node-RED is a browser-based, flow-based programming tool built on Node.js that is built into some industrial control products and also runs on small devices such as the Raspberry Pi. [2]

CISA's Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, does not list the flaw at the time of writing. FIRST's EPSS exploitation-probability score was 0.009 on 3 November. [1]

What is not yet known

The coverage available does not say how many devices have been compromised, who is behind the attacks, or which Siemens firmware version fixes the flaw. Details should be taken from the Siemens advisory. [1][2]

Timeline

  1. The SANS Internet Storm Center flagged the exploitation of the Node-RED flaw in its daily briefing. [3]

  2. VulnCheck said the attacks install a Linux bot and backdoors on unprotected servers. [2]

  3. VulnCheck said attackers were exploiting CVE-2026-58115 in Siemens SIMATIC IoT2050 Advanced devices. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms rarely run these industrial devices directly, but may use them through an integrator or service provider. Attackers are exploiting the flaw without a password. [1]

What to do

  1. Ask any integrator or provider whether SIMATIC IoT2050 devices are in use and whether they are exposed to the internet. [1]
  2. Ask them to apply the guidance in the Siemens advisory. [1]

Mid-size company

A small IT or security team

What to know

Devices running Node-RED without authentication are being compromised, according to VulnCheck. [2]

What to do

  1. Inventory SIMATIC IoT2050 Advanced devices and any Node-RED instances, and check whether they are reachable from the internet. [1][2]
  2. Read the Siemens advisory and apply its mitigations. [1]
  3. Check affected devices for unexpected software or backdoors. [2]

Large enterprise

A security operations team

What to know

The flaw is rated 10.0 and is being used to deploy a Linux bot and backdoors; no KEV listing exists yet. [1][2]

What to do

  1. Find all IoT2050 and Node-RED deployments across plants and cloud, and confirm authentication is enforced. [1][2]
  2. Apply the Siemens advisory guidance and hunt for signs of the Linux bot and backdoors VulnCheck describes. [1][2]
  3. Treat any exposed, unpatched device as potentially compromised and start incident response. [2]

Sources

  1. [1]The Hacker News · Nov 3, 05:34 UTC
    Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoorscontext
  2. [2]Help Net Security · Nov 3, 12:59 UTC
    Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)context
  3. [3]SANS Internet Storm Center StormCast · Nov 4, 02:10 UTC
    SANS Stormcast Wednesday, November 4th, 2026: Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploitcontext