CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
In late October 2026, active exploitation of CVE-2026-58115 (CVSS 10.0) was confirmed against Siemens SIMATIC IoT2050 Advanced devices running Node-RED. Unauthenticated remote attackers delivered multi-stage payloads via malicious Node-RED flows, using wget and curl to pull Linux botnet binaries from attacker-controlled servers at 85.215.73[.]250 and 45.194.90[.]57. Implants were disguised as kernel worker threads and stored in memory-backed paths to evade detection. A persistent HTTP backdoor endpoint was also installed, enabling arbitrary command execution even after reboots wiped in-memory implants, compromising operational technology environments at maximum privilege. This incident underscores an accelerating threat to OT and industrial IoT infrastructure, where legacy authentication gaps and internet-exposed management interfaces continue to be weaponized. As critical infrastructure sectors face increasing regulatory scrutiny under frameworks such as NIST CSF 2.0 and IEC 62443, the exploitation of unauthenticated remote code execution vulnerabilities in industrial devices signals a dangerous convergence of IT and OT attack surfaces.
Kill Chain
