Siemens IoT2050 Gateway Flaw Rated 10.0 Exploited to Plant Persistent Linux Backdoors

Attackers have begun exploiting a maximum-severity authentication bypass in Siemens SIMATIC IoT2050 Advanced gateways to install persistent backdoors on industrial hardware, according to vulnerability intelligence firm VulnCheck, which caught the activity on its honeypot network.

The flaw, tracked as CVE-2026-58115, carries a CVSS score of 10.0. Siemens disclosed it in August 2026, warning that devices running Industrial OS with Node-RED installed fail to enforce authentication on the Node-RED HTTP interface. That gap lets an unauthenticated remote attacker build malicious flows and run arbitrary code on the underlying server with the highest privileges.

Node-RED, a flow-based programming tool built on Node.js, is widely deployed for workflow automation in industrial control systems and operational technology environments and ships inside commercial products including the IoT2050 line. VulnCheck researcher Patrick Garrity said two built-in nodes make the bug "trivial to weaponize": an inject node that fires a message on a schedule or at startup, and an exec node capable of running shell commands. "Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction," he wrote.

The first observed hit arrived on October 30, 2026, from a single address, 4.201.105[.]116, hosted in Microsoft's AS8075 network and geolocating to Brazil. "It didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows," Garrity noted. "The attacker's request was a complete exploit. It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding."

In the initial payload, the malicious flow launches a shell script wrapper that uses wget to fetch an AMD64 botnet binary from 85.215.73[.]250, falling back to curl if wget fails, then saves the file as "/dev/shm/.b" and executes it. The operators later shifted to a two-stage chain that retrieves a second script, "wget.sh," from the same host. A separate request was seen pulling a payload called ".sys_update" from 45.194.90[.]57:38472 and storing it as "/tmp/.kworker" to mimic a kernel worker thread.

Some requests skipped the downloader entirely. Those flows exposed an HTTP-in endpoint, such as /cmd or a randomly named path, wired through a function node to an exec node with addpay enabled, letting the intruder run commands later by passing them in a query parameter. "This backdoor survives even if a memory-backed implant is lost on reboot," Garrity said.

The researchers could not retrieve the binary or staged scripts, so what "wget.sh" or ".kworker" does once running remains unknown. The filename bot-linux-amd64 points to Linux on AMD64 processors and hints that the operator maintains other builds. Between October 30 and November 1, the same address targeted the Node-RED bug 16 times and logged 125 hits against eight different CVEs across the wider canary network, including a seven-year-old Apache Solr flaw tracked as CVE-2019-17558 that touches Camunda, Gitea, MLflow, Traefik and Joomla. Because the download host is a separate machine from the one sending the exploit, the likely arrangement is scan-and-infect: hosts that find vulnerable instances pull the implant from a dedicated server.

Siemens has fixed the issue in Industrial OS versions 4.3.4.1 and later. For devices that cannot be patched immediately, the company recommends removing Node-RED or hardening it by enabling HTTPS, protecting the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and placing basic authentication in front of HTTP nodes and the Node-RED dashboard.

The campaign adds to a run of attacks on internet-exposed OT and ICS equipment, including hacks on refrigeration controllers in Europe and on water systems in at least 12 US states over the summer. VulnCheck has added CVE-2026-58115 to its Known Exploited Vulnerabilities catalog; as of publication it had not appeared in the US Cybersecurity and Infrastructure Security Agency's KEV list.

For operators, the exposure is acute because Node-RED frequently sits on gateways that bridge plant-floor equipment and corporate networks. A single unpatched device reachable from the internet can hand an intruder command execution at the highest privilege level and a foothold that persists across reboots. Garrity's advice was blunt: "If you run Node-RED anywhere, including inside OT environments, check today whether it's reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation." The mix of old and new bugs across unrelated products suggests opportunistic mass scanning rather than a targeted campaign, he added.