---
title: "Siemens IoT2050 Flaw Exploited to Plant Node-RED Backdoors"
date: 2026-11-03
author: "Sofia Ramirez"
featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/11/siemens-gateway-vulnerabiltiy-exploit.jpg"
categories:
  - name: "Cybersecurity"
    url: "/cybersecurity.md"
tags:
  - name: "News"
    url: "/tag/news.md"
---

# Siemens IoT2050 Flaw Exploited to Plant Node-RED Backdoors

VulnCheck caught attackers exploiting CVE-2026-58115, a CVSS 10.0 Siemens SIMATIC IoT2050 flaw, against its honeypots on 30th October, 2026. Some payloads skipped malware entirely and planted a Node-RED command backdoor that survives a reboot.

## Key Facts

- Siemens rated CVE-2026-58115 at 10.0 on CVSS and fixed it in IoT2050 Advanced version V4.3.4.1.
- VulnCheck logged 16 exploit attempts against the Node-RED flaw from a single IP address over three days.
- The same address fired 125 requests at eight different CVEs, including a seven-year-old Apache Solr bug.
- VulnCheck researcher Patrick Garrity called the flaw “trivial to weaponize” because two built-in Node-RED nodes chain into instant command execution.

## One POST request carried the whole attack

The bug lives in Node-RED, the Node.js-based flow programming tool that ships on **Siemens’ SIMATIC IoT2050 Advanced industrial gateways**. Affected devices don’t enforce authentication on its HTTP interface. Anyone who reaches it can deploy flows that run code with maximum privileges, according to Siemens [security advisory SSA-834709](https://cert-portal.siemens.com/productcert/html/ssa-834709.html).

VulnCheck’s canary network traced the first attempt to 4.201.105\[.\]116, an address in **Microsoft’s AS8075 network** that geolocates to Brazil. It didn’t bother scanning first. The request packed the flow and the dropper into a single POST /flows call, wrapped in three layers of encoding.

Garrity’s explanation is simple. An inject node fires a message at startup or on a schedule, while an exec node runs shell commands. Wire them together and the command executes the moment the flow deploys, with nobody clicking anything.

In that first wave, a shell script used wget to pull an **AMD64 Linux bot from 85.215.73\[.\]250**, with curl as a fallback. The binary landed at /dev/shm/.b and ran. Its filename, bot-linux-amd64, suggests the operator may keep builds for other chip architectures.

> 🇩🇪 Siemens SIMATIC IoT2050 flaw is now exploited in the wild CVE-2026-58115 (CVSS 10): no auth on Node-RED lets attackers run code as root. Since Oct 30 they drop a Linux bot or a hidden backdoor. Patch out since Aug: V4.3.4.1+ or remove Node-RED. Source: Siemens, VulnCheck https://t.co/NebBVVYz2k
> 
> — Phantom Radar🐦‍⬛ (@phantmradar) [November 3, 2026](https://x.com/phantmradar/status/2117502019183525937?ref_src=twsrc%5Etfw)

## A backdoor that outlives the bot

The operators later moved to a two-stage chain, using wget to fetch a script called wget.sh from the same server. Another request pulled a payload named **.sys\_update from 45.194.90\[.\]57:38472**. It saved the file as /tmp/.kworker, posing as a kernel worker thread, and launched it.

Several requests carried no downloader at all. Those flows exposed an HTTP endpoint such as /cmd and routed it through a function node into an exec node. The attacker could then send commands later through a query parameter. “**This backdoor survives even if a memory-backed implant is lost on reboot**,” Garrity said.

VulnCheck never retrieved the bot, wget.sh or .kworker, so their behavior after launch is unknown. The download host also differs from the exploiting machine. Garrity reads that as a scan-and-infect setup, where exploiting hosts pull implants from a dedicated server.

The targeting looks indiscriminate. The Brazil-linked address also hit [CVE-2019-17558](https://sqmagazine.co.uk/kev-tracker/) in Apache Solr and sent probes at Camunda, [Gitea](https://sqmagazine.co.uk/gitea-vulnerability-exposed-private-container-registries/), MLflow, Traefik and Joomla. Garrity sees that mix as opportunistic mass scanning.

For OT owners, that’s little comfort, since a bot doesn’t check whether a box runs a production line. Exposed OT has already drawn real attacks, like refrigeration controller hacks in Europe and summer water system attacks in at least 12 US states.

The timing tells its own story. When the CVE record went live in August, CISA’s enrichment data listed exploitation as “**none**.” The same entry flagged the flaw as automatable with total technical impact. Less than three months later, the automated exploitation arrived.

VulnCheck’s data still leaves gaps. What does bot-linux-amd64 do once running? Has any real IoT2050 gateway, beyond a VulnCheck canary, been compromised? And how many Node-RED instances inside OT networks answer requests from the open internet?

## What’s Next?

Siemens tells IoT2050 Advanced owners to update to V4.3.4.1 or later. Where patching has to wait, it advises uninstalling Node-RED or hardening it. That means **HTTPS**, **credential** or **OAuth/OpenID login** for the editor and admin API, and basic authentication on HTTP nodes and the Dashboard. The advisory also urges customers to “**protect network access to devices with appropriate mechanisms.**“

These steps help reduce risk, but a patch may not remove a flow that’s already planted. Teams should audit deployed flows for unfamiliar HTTP endpoints wired to exec nodes and confirm Node-RED isn’t reachable from outside the network.