A CVSS 10 in a Factory Gateway: Siemens IoT2050 Node-RED Flaw Is Now Being Exploited

Yesterday I wrote that the next major cyberattack might turn off your water. Today's reminder of how that happens isn't exotic. It's a flaw with no authentication, a perfect severity score, and a patch that's been out since August.

What Happened

Siemens published advisory SSA-834709 on August 11 for CVE-2026-58115 in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. The Node-RED HTTP interface doesn't enforce authentication, so an unauthenticated remote attacker can create malicious flows and run code with maximum privileges. CVSS 10.0. Fixed in V4.3.4.1.

VulnCheck now reports attackers hitting its honeypots with this as of October 30. According to The Hacker News write-up of VulnCheck's findings:

• The basic play: push a Node-RED flow that triggers on its own, downloads a Linux bot with wget (curl as a fallback) and runs it from /dev/shm/.b.
• The upgraded play: a two-stage chain that pulls a second script, then a payload dressed up as a kernel worker at /tmp/.kworker.
• The quiet play: no download at all. The flow just adds an HTTP endpoint (like /cmd) that runs whatever command arrives in a query parameter. That backdoor lives in the flow, so it survives a reboot that would wipe an in-memory implant.

Researchers couldn't retrieve the second-stage payload, so what it ultimately does is unknown.

Why This Matters

The IoT2050 is an edge gateway: the box that sits between the plant floor and everything else, collecting data and moving it around. Node-RED is popular there for a good reason. It makes wiring things together easy. That's also the problem. A Node-RED editor reachable without a login is a remote code execution console with a friendly drag-and-drop UI.

Two things stand out to me:

1. Ten weeks from patch to exploitation. Not great, not unusual for OT, where "update the gateway" can mean a maintenance window and a site visit.
2. The persistence is in the config, not the binary. A malicious flow is just application logic. Reimaging memory won't remove it, and it won't look like malware to tools that only check files.

What To Do

• Update to V4.3.4.1 or later. That's the fix.
• If you don't use Node-RED on the device, uninstall it. Siemens lists that as a mitigation.
• If you do, lock it down: HTTPS, credentials or OAuth/OpenID on the editor and admin API, and basic auth on HTTP nodes and the dashboard, per the Node-RED security guide.
• Never expose it to the internet. Remote access to OT gear should go through an authenticated broker, not an open port.
• Hunt now: look for flows you didn't create, unexpected HTTP endpoints, and files like /dev/shm/.b and /tmp/.kworker. VulnCheck's write-up lists associated IPs.

Bottom Line

A maximum severity bug in an industrial gateway, unauthenticated, patched in August, exploited in October. That's the whole OT security problem in one sentence. If you have IoT2050s in the field, find out today whether Node-RED is on them and who can reach it.

Sources: Siemens SSA-834709, VulnCheck, exploitation targeting Node-RED, The Hacker News, and Node-RED, securing Node-RED