{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/simatic-iot2050-advanced--4.3.4.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:siemens:simatic_iot2050_advanced:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-58115"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SIMATIC IoT2050 Advanced (\u003c 4.3.4.1)"],"_cs_severities":["critical"],"_cs_tags":["industrial-security","iot","vulnerability","remote-code-execution","botnet"],"_cs_type":"advisory","_cs_vendors":["Siemens"],"content_html":"\u003cp\u003eSiemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are vulnerable to a missing authentication flaw (CVE-2026-58115) within the Node-RED HTTP interface. This vulnerability allows an unauthenticated remote attacker to create malicious flows, execute arbitrary code, and establish persistent backdoors with maximum privileges. The issue was remediated in version 4.3.4.1. Active exploitation attempts have been observed, involving the deployment of secondary botnet binaries and shell scripts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a crafted, unauthenticated HTTP request to the Node-RED interface of the targeted SIMATIC IoT2050 device.\u003c/li\u003e\n\u003cli\u003eThe malicious request deploys a Node-RED flow to the target.\u003c/li\u003e\n\u003cli\u003eThe flow is automatically triggered upon deployment.\u003c/li\u003e\n\u003cli\u003eThe flow executes a shell command wrapper using the internal 'exec' node.\u003c/li\u003e\n\u003cli\u003eThe shell wrapper utilizes 'wget' or 'curl' to retrieve a secondary payload from an attacker-controlled server (e.g., 85.215.73.250).\u003c/li\u003e\n\u003cli\u003eThe retrieved binary or script is saved to a directory such as '/dev/shm/' or '/tmp/'.\u003c/li\u003e\n\u003cli\u003eThe payload is executed to establish the botnet presence or expose an arbitrary command-execution endpoint (e.g., /cmd).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SIMATIC IoT2050 Advanced firmware to version 4.3.4.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not possible, uninstall Node-RED from the device.\u003c/li\u003e\n\u003cli\u003eIf Node-RED is required, harden the interface by enabling HTTPS and enforcing credential-based authentication for the editor, Admin API, HTTP nodes, and Dashboard.\u003c/li\u003e\n\u003cli\u003eBlock communication to identified malicious IPs (85.215.73.250 and 45.194.90.57) at the network perimeter.\u003c/li\u003e\n\u003cli\u003eAudit Node-RED instances for unexpected HTTP endpoints or active \u0026quot;exec\u0026quot; nodes in configured flows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T07:07:48Z","date_published":"2026-11-03T07:07:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-siemens-iot2050-exploit/","summary":"Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices to deploy botnet payloads and establish persistent backdoors.","title":"Siemens SIMATIC IoT2050 Advanced: Missing authentication remote code execution (CVE-2026-58115)","url":"https://feed.craftedsignal.io/briefs/2026-11-siemens-iot2050-exploit/"}],"language":"en","title":"CraftedSignal Threat Feed - SIMATIC IoT2050 Advanced (\u003c 4.3.4.1)","version":"https://jsonfeed.org/version/1.1"}