Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
Summary: VulnCheck reported active exploitation of CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS, which Siemens disclosed in an August 2026 advisory and fixed in version 4.3.4.1 or later. On October 30, 2026, VulnCheck saw attackers hit its honeypots with a full exploit that deployed a Node-RED flow, triggered it, and pulled an AMD64 botnet binary from 85.215.73[.]250 via wget with curl as fallback, saving it as /dev/shm/.b and executing it.
Key Takeaway: Later requests skipped the downloader entirely and wired an HTTP endpoint such as /cmd through a function node to an exec node, giving the attacker a command backdoor that survives a reboot even if the memory-backed implant is lost.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-58115
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026