Attackers weaponize Siemens IoT2050 flaw to deploy botnet

As of October 30, 2026, VulnCheck had observed attackers trying to weaponize CVE-2026-58115 against its honeypot network with what amounted to a complete, self-contained exploit. A single HTTP request to a Siemens SIMATIC IoT2050 Advanced device deployed a Node-RED flow, triggered it, and pulled a Linux bot binary from an attacker-controlled server, with the whole payload wrapped in three layers of encoding.

The vulnerability is a missing-authentication flaw in the Node-RED HTTP interface on IoT2050 Advanced devices running Industrial OS, and it carries a CVSS score of 10.0. Node-RED lets you build flows that run arbitrary logic on the device. With no authentication in front of the interface, an unauthenticated remote attacker can create a flow that executes code on the underlying server with maximum privileges. Siemens published the advisory in August 2026 and fixed the issue in Industrial OS version 4.3.4.1 and later.

The deployed flow runs a shell script wrapper that uses wget to fetch an AMD64 botnet binary from 85.215.73[.]250, falling back to curl if wget fails. The binary is written to /dev/shm/.b, a tmpfs path that keeps it in memory, and executed.

The operators have since moved to a two-stage approach. The first wget now retrieves a second shell script, wget.sh, from the same server. A separate request reaches out to 45.194.90[.]57:38472 for a payload called .sys_update, writes it to /tmp/.kworker to pass it off as a kernel worker thread, and runs it. VulnCheck could not retrieve wget.sh or .kworker, so what they do is unknown.

The variant worth the most attention drops no binary at all. Instead of fetching a payload, the flow stands up an HTTP in endpoint (/cmd in one sample, a randomly named path in others) wired through a function node into an exec node with addpay enabled. That leaves the device running a command endpoint the attacker can hit later, passing shell commands as a query parameter. VulnCheck’s Patrick Garrity noted that this backdoor survives a reboot even when a memory-backed implant like /dev/shm/.b does not.

If you run IoT2050 Advanced devices, the fix is the 4.3.4.1 Industrial OS update. If you can’t patch immediately, Siemens’ mitigations are to uninstall Node-RED, or harden it: enable HTTPS, put credential-based authentication or an OAuth/OpenID provider in front of the editor and admin API, and apply basic authentication to the HTTP Nodes and the Node-RED Dashboard. The exploit hits the unauthenticated HTTP interface directly, so authentication on the admin API is what breaks the chain.

Because one of the payloads installs a persistent exec endpoint rather than a file, patching alone won’t tell you whether a device was already compromised. Inspect deployed Node-RED flows for exec nodes and unexpected HTTP in endpoints, check for files at /dev/shm/.b and /tmp/.kworker, and treat outbound connections to 85.215.73[.]250 and 45.194.90[.]57:38472 as indicators. Any device that sat reachable and unpatched between August and now is worth inspecting, not just updating.