Skip to content
Critical Siemens IoT2050 Flaw Exploited for Linux Malware Deployment

Critical Siemens IoT2050 Flaw Exploited for Linux Malware Deployment

First seen 3 Nov 2026, 06:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 09:43 UTC
  • •CVE-2026-58115 is a critical flaw with a CVSS score of 10.0, allowing remote code execution.
  • •Attackers have exploited this vulnerability to deploy persistent Linux malware on Siemens IoT2050 gateways.
  • •Siemens recommends updating to Industrial OS version 4.3.4.1 or later to mitigate the vulnerability.

A critical vulnerability, CVE-2026-58115, affecting Siemens SIMATIC IoT2050 Advanced gateways has been. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to execute arbitrary code by exploiting a missing authentication in the Node-RED HTTP interface. VulnCheck reported that attackers have begun using this vulnerability to install persistent Linux backdoors. The first recorded exploit occurred on October 30, 2026, with attackers deploying a malicious Node-RED flow that downloads and executes a bot binary. The attacks were traced back to a single IP address geolocated in Brazil, which targeted the flaw 16 times in just a few days. Siemens has recommended updating to Industrial OS version 4.3.4.1 or later to mitigate the risk. The ongoing exploitation highlights the urgent need for organizations using affected devices to secure their installations immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2019-11-25
Public exploit for CVE-2019-17558 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-08-11
CVE-2026-58115 published
Siemens disclosed the critical vulnerability affecting IoT2050 gateways, rated 10.0 on the CVSS scale.
Sploitus
2026-10-30
First exploitation observed
VulnCheck reported the first attack exploiting CVE-2026-58115, deploying a malicious Node-RED flow.
Finance.Biggo
2026-11-01
Multiple exploit attempts logged
The same IP address targeted the Node-RED flaw 16 times and logged 125 hits against various CVEs.
Mezha

More articles in this cluster (7)

Following this threat?

Track Siemens and CVE-2019-17558 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4

Common questions

What devices are affected by CVE-2026-58115?
The vulnerability affects Siemens SIMATIC IoT2050 Advanced gateways running Industrial OS with Node-RED installed.
How can I mitigate this vulnerability?
Update to Industrial OS version 4.3.4.1 or later, or secure your Node-RED installation by enabling authentication.
What is the nature of the attacks observed?
Attackers are exploiting the flaw to deploy malicious Node-RED flows that download and execute Linux bot binaries.