Siemens SIMATIC IoT2050 Advanced: Missing authentication remote code execution (CVE-2026-58115)

Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are vulnerable to a missing authentication flaw (CVE-2026-58115) within the Node-RED HTTP interface. This vulnerability allows an unauthenticated remote attacker to create malicious flows, execute arbitrary code, and establish persistent backdoors with maximum privileges. The issue was remediated in version 4.3.4.1. Active exploitation attempts have been observed, involving the deployment of secondary botnet binaries and shell scripts.

Attack Chain

1. Attacker sends a crafted, unauthenticated HTTP request to the Node-RED interface of the targeted SIMATIC IoT2050 device.
2. The malicious request deploys a Node-RED flow to the target.
3. The flow is automatically triggered upon deployment.
4. The flow executes a shell command wrapper using the internal 'exec' node.
5. The shell wrapper utilizes 'wget' or 'curl' to retrieve a secondary payload from an attacker-controlled server (e.g., 85.215.73.250).
6. The retrieved binary or script is saved to a directory such as '/dev/shm/' or '/tmp/'.
7. The payload is executed to establish the botnet presence or expose an arbitrary command-execution endpoint (e.g., /cmd).

Recommendation

• Upgrade SIMATIC IoT2050 Advanced firmware to version 4.3.4.1 or later immediately.
• If upgrading is not possible, uninstall Node-RED from the device.
• If Node-RED is required, harden the interface by enabling HTTPS and enforcing credential-based authentication for the editor, Admin API, HTTP nodes, and Dashboard.
• Block communication to identified malicious IPs (85.215.73.250 and 45.194.90.57) at the network perimeter.
• Audit Node-RED instances for unexpected HTTP endpoints or active "exec" nodes in configured flows.