Attackers exploit Node-RED flaw in Siemens SIMATIC IoT2050 gateways

Attackers exploit Node-RED flaw in Siemens SIMATIC IoT2050 gateways

2 November 2026: A missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced gateways, CVE-2026-58115, is being exploited. VulnCheck says one of its decoy systems was hit on 30 October by a complete exploit that installed a Linux bot, and it has since logged 16 attempts from the same address. Siemens rated the flaw CVSS 10.0 and fixed it in Industrial OS V4.3.4.1 when it published advisory SSA-834709 on 11 August.

Not yet independently verified. Exploitation has been reported by VulnCheck from its own sensors; Siemens has not updated its advisory to say the flaw is exploited, and we found no entry in the CISA KEV catalogue. We will update this when it can be confirmed, and remove this note.

Which devices are exposed

The advisory covers one product: SIMATIC IoT2050 Advanced (order number 6ES7647-0BA00-1YA2) running Industrial OS below V4.3.4.1 with Node-RED installed. On those devices the Node-RED HTTP interface does not require a login, so anyone who can reach it can create flows, including flows that run system commands, with the highest privileges on the device.

• Affected: SIMATIC IoT2050 Advanced, Industrial OS below V4.3.4.1, Node-RED installed
• Fixed: Industrial OS V4.3.4.1 or later
• If you cannot update: uninstall Node-RED, or harden it and block network access to its interface

How the attack works

VulnCheck's write-up shows how little an attacker needs. The request deploys a Node-RED flow that pairs a node firing once at start-up with a node that runs a shell command. The command, hidden behind three layers of encoding, downloads a binary called bot-linux-amd64 into memory-backed storage and starts it in its own session so it outlives the Node-RED process. The request came from an address in Microsoft's network. VulnCheck did not analyse the bot itself and makes no claim about what it does.

VulnCheck also points out that Node-RED is embedded in other industrial products, naming Emerson's documentation as one example, though it has not checked whether those are affected by this flaw.

Checking plants and remote sites

IoT2050 gateways often sit at the edge of a production network, collecting machine data and passing it on to other systems, so a device that was set up once and forgotten is the likely victim. Plant and OT teams should find every IoT2050 Advanced in the estate, confirm the Industrial OS version, and check whether Node-RED's interface is reachable from any network that is not strictly local. Unexpected flows in the Node-RED editor, or a hidden file in memory-backed storage under /dev/shm, are the signs VulnCheck's analysis suggests looking for.

Sources

• Siemens ProductCERT SSA-834709: Missing authentication vulnerability in Node-RED on SIMATIC IoT2050 Advanced with Industrial OS, 11 August 2026
• VulnCheck: Exploitation targeting Node-RED, a tool embedded in ICS products, 2 November 2026
• heise online: Siemens Simatic IoT2050 attacked (German), 3 November 2026