Siemens SIMATIC IoT2050 Advanced: attackers can run their own code
WHAT IT IS · BUSINESS SOFTWAREIt runs day-to-day business work such as finance, printing, phones or manufacturing.
DO THIS FIRSTAsk the vendor or the team that owns it whether the fix is in. Not sure if you use it? Send this page to your IT provider or security lead and ask.
TECHNICAL SUMMARY A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.
WHY THIS VERDICT Attacks are reported but not confirmed by an authoritative source, and the vulnerability is more than 90 days old.
WHY IT RANKS HERE Exploitation is reported. The first report is 8 days old. 5 products are affected.
- HIGHEST CONFIRMED RUNG
- TALK
- CISA KEV
- NOT YET
- EXPLOIT CODE
- PROOF OF CONCEPT
How far has it climbed?
01 TALK
■ CONFIRMEDNEWEST EVIDENCE · 5 INDEPENDENT SOURCESCVE-2026-58115 discussed publicly (CIRCL sighting). CVE-2026-58115 discussed publicly (CIRCL sighting).
- SRC: CIRCL Vulnerability-Lookup sightings: CVE-2026-58115 discussed publicly (CIRCL sighting) · NOV 9
- SRC: Help Net Security: Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) · NOV 3
- SRC: The Hacker News: Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors · NOV 2
- SRC: The Register (security): Max-severity bug in widely used OT programming tool exploited to deliver Linux malware · NOV 2
02 EXPOSED
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETWe have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.
03 TRIED
▨ REPORTED, NOT CONFIRMEDNEWEST EVIDENCE · 1 SOURCEAttacks that worked are reported (step 4), so attempts count as reported too.
04 EXPLOITED
▨ REPORTED, NOT CONFIRMEDNEWEST EVIDENCE · 1 SOURCEExploitation of CVE-2026-58115 reported (CIRCL sighting).
05 DAMAGE
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETBreach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.
When each thing happened
- DISCLOSED
- EXPLOIT CODE PUBLIC
- FIRST ATTACK REPORT
- CISA KEV LISTINGNOT YET
- US FEDERAL DEADLINENOT YET
Questions to ask this week
- Do we run Siemens SIMATIC IoT2050 Advanced? If yes, is it patched or cut off from the internet?
- Who owns fixing it, and by what date?
- Have we checked for signs of attack since the first report, not just since the patch?
How it unfolded
- NOV 2, 2026Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
- NOV 2, 20262 public GitHub repositories claim a proof of concept for CVE-2026-58115
- NOV 2, 2026Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
- Attack activity. NOV 3, 2026Exploitation of CVE-2026-58115 reported (CIRCL sighting)
- NOV 3, 2026CVE-2026-58115 discussed publicly (CIRCL sighting) (36 reports, latest NOV 9)
- NOV 3, 2026Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
- NOV 3, 2026[Control systems] Siemens security advisory (AV26-802) – Update 1
- NOV 3, 2026Public proof of concept for CVE-2026-58115 (CIRCL sighting)
SOURCES
- [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-58115 discussed publicly (CIRCL sighting), NOV 9
- [2] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-58115 (CIRCL sighting), NOV 3
- [3] Canadian Centre for Cyber Security: [Control systems] Siemens security advisory (AV26-802) – Update 1, NOV 3
- [4] Help Net Security: Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115), NOV 3
- [5] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-58115 reported (CIRCL sighting), NOV 3
- [6] The Hacker News: Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors, NOV 2
- [7] PoC-in-GitHub: 2 public GitHub repositories claim a proof of concept for CVE-2026-58115, NOV 2
- [8] The Register (security): Max-severity bug in widely used OT programming tool exploited to deliver Linux malware, NOV 2
- [9] CIRCL Vulnerability-Lookup sightings: 35 more reports