Siemens IoT2050 CVE-2026-58115 plants remote command backdoors

Siemens SIMATIC IoT2050 Advanced units are under live attack. CVE-2026-58115 scores 10.0. On Industrial OS builds that still have Node-RED installed, the Node-RED web interface never asks who is calling a function that should have been locked. A remote party with no account can add flows and run code with the highest privileges on the device. That box often sits between a plant network and a path outward. A shell there is a pivot.

Siemens published the advisory in August 2026. The remediated line is Industrial OS 4.3.4.1 and newer. Until that build is on the device, Siemens’ own containment advice is to uninstall Node-RED, or to harden what remains: serve it only over HTTPS, require a real login or an identity provider on the editor and the admin API, and require authentication on HTTP nodes and the dashboard. Those steps shrink the door. They do not replace the fixed release.

What showed up on a honeypot

VulnCheck researcher Patrick Garrity said that by October 30, 2026 the company’s honeypots were receiving finished attempts, not empty scans. The traffic tried to stand up a flow and then retrieve a Linux bot from servers the attackers control. Later attempts split the download into a second stage. Another request tried to fetch a different program. VulnCheck could not recover that file, so its job is still unknown.

A separate pattern skipped the download. It left a flow that can take commands on a later visit. A bot that lived only in memory can disappear on reboot. A flow written on the device can still be waiting. Garrity’s account is that the honeypot saw a complete attempt: deploy, trigger, and fetch, wrapped so the contents were not sitting in the clear.

This desk will not repeat the request layout, the encoding, the retrieval commands, or the file names. Teams that hunt from their own sensors can read VulnCheck’s note. Operators need the version and the fact that the attempts are already in the wild.

What to do on the plant floor

Inventory every SIMATIC IoT2050 Advanced and read the Industrial OS version on the device. Anything older than 4.3.4.1 that still has Node-RED is in the set being probed. Schedule the fixed release in the change window you already use for operational technology, then confirm the version string after the install.

If that window is still days away, take Node-RED off or apply the hardening so the editor, the admin API, and the dashboard stop answering anonymously. Keep the HTTP interface off any routable address while you wait. A maximum-severity bug with honeypot hits belongs in this week’s work, not next quarter’s.

Treat an IoT2050 that was reachable and unpatched through late October as suspect. Look for flows nobody on the controls team created, unfamiliar programs, and outbound fetches that do not match the device’s job. Reboot clears a memory-only implant and leaves a stored flow in place. When the signals are muddy, rebuild from a known-good image and rotate credentials that device could reach.

These gateways collect plant data. A command hook on one of them is a site incident. Segment them from the rest of the network, and keep a record of which units still run Node-RED so the next advisory does not start with a spreadsheet argument.

This briefing relies on public reporting by The Hacker News and on notes from Siemens and VulnCheck. It does not include exploit procedures.