Siemens Simatic IoT2050 Advanced devices are under attack online. A vulnerability gives attackers extensive access rights. They are installing a botnet on vulnerable devices.
That’s according to IT security company VulnCheck . One of the company’s systems logged an attempt last Friday to exploit vulnerability CVE-2026-58115 (CVSS 10.0 , risk “ critical ”). The vulnerability was reported in August and patched with an update. It affects Simatic IoT2050 Advanced devices running versions earlier than 4.3.4.1 with Node-RED installed — a Node.js-based tool for flow-based programming. The Node-RED web interface could be accessed without authentication. That means attackers can program nodes through it without logging in first and execute system commands on the server — including arbitrary malicious code with the highest privileges.
Siemens responded with its security advisory and released firmware version 4.3.4.1 or later to resolve the problem. However, IT administrators must install it themselves. Alternatively, admins can uninstall Node-RED or harden its installation; the advisory lists as possible mitigations.
IT administrators should check whether they operate IoT hardware at network boundaries or leave it accessible from the internet, since attackers also look for and exploit vulnerabilities in these devices. They should also promptly apply updates or temporary mitigations.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
