Siemens SIMATIC IoT2050 Node-RED flaw exploited to drop Linux bot payloads

What happened

CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 devices running Industrial OS with Node-RED installed. The devices do not enforce authentication on programming nodes capable of executing system commands, so an unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges. The flaw is now being exploited in the wild.

On October 30, 2026, one of VulnCheck's canaries caught an attacker exploiting the flaw with a single POST /flows request. The deployed flow's exec node piped a base64 string through base64 -d into sh, and the dropper pulled bot-linux-amd64 from 85.215.73.250 on port 8080, saving it as /dev/shm/.b, a RAM-backed path where nothing is written to disk. Other variants fetched wget.sh from the same server and .sys_update from 45.194.90.57 on port 38472, saving the latter as /tmp/.kworker, a name that mimics a kernel worker thread.

The exploit came from 4.201.105.116 in Microsoft's AS8075. VulnCheck notes such cloud addresses are more often compromised or rented virtual machines than an operator's own hardware. VulnCheck saw that IP hit this CVE 16 times between October 30 and November 1 and calls the activity opportunistic mass scanning rather than a targeted attack.

Why it matters

This is a maximum-severity flaw in an ICS product. An attacker can wire an "inject" node to an "exec" node so a shell command runs as soon as the flow is deployed. The binary in /dev/shm/ disappears on reboot unless the bot sets up persistence by other means, but some requests planted a webshell instead: an http in endpoint wired to an exec node, which survives a reboot. VulnCheck says Node-RED instances without adminAuth are being found and exploited automatically. Node-RED is used across manufacturing, utilities and critical infrastructure.

Who is affected

• Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)
• Siemens SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2)
• Siemens SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2)
• Siemens SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)
• Versions: All versions below V4.3.4-1 running Industrial OS with Node-RED installed.

What to do now

1. Update all four SIMATIC IoT2050 models to V4.3.4-1 or later.
2. Uninstall Node-RED if it is not strictly required for your operation.
3. Enable HTTPS access for the Node-RED interface.
4. Secure the editor and admin API using credential-based authentication or an OAuth/OpenID provider.
5. Secure all HTTP Nodes and the Node-RED Dashboard using basic authentication.
6. Check whether Node-RED can be reached from outside your network, and review deployed flows for unexpected exec nodes or HTTP endpoints.
7. Hunt for the published IOCs: 4.201.105.116, 85.215.73.250, 45.194.90.57, /dev/shm/.b and /tmp/.kworker.

What we don't know yet

• What the bot-linux-amd64 binary and the wget.sh and .kworker payloads do. VulnCheck did not retrieve them.
• Whether any Siemens SIMATIC IoT2050 device has been compromised. No source reports one.
• How many systems have been successfully exploited worldwide.