November 4, 2026

Missing Authentication in Node-RED on Siemens SIMATIC IoT2050 Advanced Exploited to Deploy Linux Malware

Security Advisory Brief

A maximum-severity vulnerability in the Node-RED programming environment shipped with Siemens SIMATIC IoT2050 Advanced gateways is being actively exploited to execute arbitrary commands on affected devices. Tracked as CVE-2026-58115 and carrying a CVSS v3.1 base score of 10.0 and a CVSS v4.0 base score of 10.0, the flaw stems from the Node-RED HTTP interface failing to enforce authentication. Any attacker able to reach the interface over the network can access programming nodes and run operating-system commands with the highest privileges, with no credentials and no user interaction required.

Node-RED is a widely deployed flow-based programming tool used to wire together devices, sensors, and services in operational technology and industrial IoT environments. On the SIMATIC IoT2050 Advanced, it runs on the Siemens Industrial OS and is frequently exposed at the edge of plant networks, where it bridges field devices to higher-level systems. Because the vulnerability allows unauthenticated command execution, an attacker can create malicious flows that chain Node-RED's own nodes to download and launch external payloads, giving the attacker a durable foothold on the device.

Security researchers have reported that the flaw is under active exploitation in the wild as of late October 2026, with opportunistic scanning used to locate exposed interfaces and deliver a Linux bot binary and web shells to compromised gateways. The combination of a perfect severity score, trivial exploitation, and confirmed in-the-wild activity places affected organizations at immediate risk and makes prompt patching and exposure review a priority for any site running these gateways.

Threats and Vulnerabilities

CVE-2026-58115, with a CVSS v3.1 score of 10.0 and a CVSS v4.0 score of 10.0, is a missing-authentication vulnerability (CWE-306) affecting Siemens SIMATIC IoT2050 Advanced (article number 6ES7647-0BA00-1YA2) devices running the Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. On affected devices the Node-RED HTTP interface does not require authentication, so a remote, unauthenticated attacker who can reach the interface gains access to programming nodes that can execute system commands. By deploying a malicious flow, the attacker can run arbitrary code with maximum privileges on the gateway, effectively taking full control of the device. Public reporting indicates that attackers have been exploiting the flaw since at least 30 October 2026, using mass scanning to find internet-reachable instances and then wiring an inject node to an exec node that downloads a Linux bot binary into memory and executes it; additional payloads and web shells have also been observed. The behavior to date appears opportunistic rather than targeted, but the low barrier to exploitation and the device's position at the IT/OT boundary mean a successful compromise can serve as a pivot point into the wider control environment. Siemens has published a fixed release and interim mitigations, and the vulnerability has also been documented by CISA in an industrial control systems advisory.

Client Impact

A successful attack gives an adversary complete control of the affected SIMATIC IoT2050 Advanced gateway, which typically sits between field devices and plant or enterprise networks. From that position an attacker can execute commands as the highest-privileged user, deploy malware such as the observed Linux bot, establish persistence, and use the gateway as a staging point to reach other systems, disrupt the data flows the device manages, or manipulate the information passed between operational technology and business systems. Because these gateways are often deployed at remote or lightly monitored sites and may be exposed to the internet, exploitation can occur with little chance of early detection, and a single compromised device can undermine the integrity and availability of the processes it supports.

Beyond the direct operational risk, exploitation carries regulatory and compliance consequences for organizations subject to critical-infrastructure and industrial-security obligations. Unauthenticated remote code execution on an OT asset can constitute a reportable security incident under frameworks such as NERC CIP, the NIS2 Directive, and sector-specific mandates, and may trigger notification, investigation, and remediation requirements. Failure to apply available fixes to a maximum-severity, actively exploited vulnerability can also weaken an organization's standing in audits and insurance assessments and increase exposure to downstream liability if a compromise affects safety or service delivery.

Mitigations

Organizations operating SIMATIC IoT2050 Advanced devices should take the following actions to reduce exposure to CVE-2026-58115:

Update affected SIMATIC IoT2050 Advanced devices to Industrial OS version V4.3.4.1 or later, which Siemens has identified as the fixed release that resolves the vulnerability.
Where immediate updating is not possible, enable and enforce authentication on the Node-RED interface and restrict access so that only authorized engineering hosts can reach it, following Siemens' advisory guidance.
Remove affected gateways from direct internet exposure, place them behind firewalls, and segment them from both business networks and the broader control environment so that the Node-RED interface is not reachable from untrusted zones.
Inspect affected devices for signs of compromise, including unexpected Node-RED flow changes, newly added inject, exec, or HTTP input nodes, hidden files in temporary directories such as /dev/shm or /tmp, and unexplained outbound network connections, and rebuild any device suspected of compromise from a known-good image.
Monitor Node-RED and gateway activity for unauthorized administrative requests to the flows interface and for outbound connections to unfamiliar external hosts, and incorporate these indicators into detection and alerting workflows.

Applying the vendor update and reducing network exposure are the most effective steps available to address this vulnerability and should be prioritized for any internet-reachable or safety-relevant deployment.

1898 & Co. Response

1898 & Co. tracks actively exploited vulnerabilities affecting operational technology and industrial IoT platforms and translates them into actionable guidance for the asset owners and operators it works alongside. Our team draws on experience supporting OT security programs across critical-infrastructure sectors to help clients understand where edge gateways such as the SIMATIC IoT2050 fit into their architecture and how a maximum-severity flaw like CVE-2026-58115 changes their risk posture.

For organizations concerned about exposure, 1898 & Co. can conduct in-depth assessments of OT and IT/OT boundary assets, identify internet-reachable or inadequately segmented Node-RED instances, and validate that vendor updates and interim mitigations have been applied correctly. These engagements are designed to reduce the window of exposure and to confirm that compensating controls are functioning where immediate patching is not feasible.

Where a compromise is suspected, 1898 & Co. provides threat hunting, incident response, and forensic support to determine whether a device has been exploited, scope the extent of any intrusion, and support recovery. By combining detection content tuned to the indicators associated with this campaign with hands-on investigation, our team helps clients move quickly from awareness to verified remediation.

Sources

Cyberthreat