Siemens IoT2050 Advanced CVSS 10 flaw actively exploited to plant backdoors
CVE-2026-58115 (CVSS 10.0) affects Siemens SIMATIC IoT2050 Advanced devices: missing authentication for a critical function lets an unauthenticated remote attacker run arbitrary code. VulnCheck captured active exploitation on honeypots, with Linux bot payloads and remote command backdoors via Node-RED. Sources mention no fix; check device exposure and isolate affected units.
What happened
A maximum-severity flaw (CVSS 10.0) in Siemens SIMATIC IoT2050 Advanced industrial devices is under active exploitation, according to VulnCheck. The attacker needs no password or credentials to run code on the device. Attacks plant remote command backdoors and Linux bot payloads.
Why it matters
Industrial and IoT devices can be remotely taken over, with risk of data theft, operational disruption, and use of the devices in attacks on third parties. Sources cite no fix, leaving the risk window open.
What to do
Check today for SIMATIC IoT2050 Advanced devices on the network and any exposure to the internet. Isolate affected units, monitor outbound traffic and Node-RED commands, and engage Siemens support about a fix.
For the technical team
- CVE
- CVE-2026-58115
- Affected
- Siemens SIMATIC IoT2050 Advanced · Siemens SIMATIC IoT2050 Advanced; versions not detailed in the available source excerpts.
- Exploitation
- Active exploitation reported by VulnCheck, which captured the attempts on its own honeypots. Attacks push Linux bot payloads and remote command backdoors via Node-RED (The Hacker News).
- Fix
- Sources mention no fix or mitigation.
- Vector
- Missing authentication for a critical function in Siemens SIMATIC IoT2050 Advanced; an unauthenticated remote attacker runs arbitrary code. The captured chain uses Node-RED to create remote command backdoors.
- More details
- Disclosure by VulnCheck based on honeypots; CVSS 10.0, maximum severity. Attacks abuse Node-RED, present on IoT2050 devices, as the persistence vector.
Timeline
VulnCheck captured exploit attempts on honeypots; attacks push Linux bot payloads and create remote command backdoors via Node-RED.
First report: VulnCheck reports active exploitation of CVE-2026-58115.
Sources 2 sources
- Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors The Hacker News
- @TheHackersNews @TheHackersNews
