{"id":3932,"date":"2026-11-03T05:43:53","date_gmt":"2026-11-03T05:43:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3932"},"modified":"2026-11-03T05:43:53","modified_gmt":"2026-11-03T05:43:53","slug":"attackers-exploit-critical-siemens-iot2050-flaw-to-plant-remote-command-backdoors","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3932","title":{"rendered":"Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 03, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Cyber Attack<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiLg0QvfH0SD_sz2pFnyrG6Zcs-ltrKaf42ZY7PYKTsA26Nu4alNeqarZZ9HGEjO0UJFr5Wfsb7WBSDYoRnGi6X1jXZ8_4xx1VJtYshtPXYX9DVJYu4lln_IqEhf-NQJC7MKWI1JVzzR5heu6O_OnWezfKsj3AnBs5NKVp5dOVgR-7XuKMIAiyiKflPlT9E\/s1700-nu-rw-lo-l85-e365\/siemens-hack.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has <a href=\"https:\/\/www.vulncheck.com\/blog\/exploitation-targeting-node-red\" target=\"_blank\">revealed<\/a>.<\/p>\n<p>The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.<\/p>\n<p>\u00abSIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges,\u00bb Siemens <a href=\"https:\/\/cert-portal.siemens.com\/productcert\/html\/ssa-834709.html\" target=\"_blank\">said<\/a> in an advisory released back in August 2026.<\/p>\n<p>The issue has been remediated in versions 4.3.4.1 or later. As mitigations, Siemens <a href=\"https:\/\/nodered.org\/docs\/user-guide\/runtime\/securing-node-red\" target=\"_blank\">recommends<\/a> that users uninstall Node-RED or harden the installation by following the steps below &#8211;<\/p>\n<ul>\n<li>Enabling HTTPS access<\/li>\n<li>Securing the editor and admin API via credential based authentication or through an OAuth\/OpenID provider<\/li>\n<li>Securing the HTTP Nodes and Node-RED Dashboard using basic authentication<\/li>\n<\/ul>\n<p>As of October 30, 2026, VulnCheck said it observed attackers attempting to weaponize CVE-2026-58115 against its honeypot network in an attempt to download and run a Linux bot.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-dd\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWypk5aSrjVVXdRpyJaxKDe9VERLYId6cVdoZUwHGSe-EMh90qROsc-jk3uEKqB8-L4eSpBaka7err1zF86IrsEA4S2IZ8yyEsoZTsiGq2YvGuaCtdFvE8-ej7uEBhLbYJNENjs9umU6qmZCJ1aAzvG-ZDO0NtTVddy5hIGv4FBpDJp8UeOxYEzF5AeuK1\/s728-nu-rw-lo-l85-e36\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abThe attacker&#8217;s request was a complete exploit,\u00bb VulnCheck researcher Patrick Garrity said. \u00abIt deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding.\u00bb<\/p>\n<p>Specifically, the malicious flow is designed to run a shell script wrapper, which uses wget to retrieve the botnet binary for AMD64 architecture from <a href=\"https:\/\/www.virustotal.com\/gui\/ip-address\/85.215.73.250\/detection\" target=\"_blank\">85.215.73[.]250<\/a>. Curl is used as a fallback if the wget attempt fails. In the final stage, the binary is saved as \u00ab\/dev\/shm\/.b\u00bb and executed.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjvbN8mGv2-FskUTBeR_2vt38nquYI2y2PEb7-jacaoTygZjBGaIl1VPE3anp5ujRz9vO7C-jTpBHGCyRPi9FoqwtnakLcblZDGIzppY2ZWIS2KhxzW_aNjLkl9CqPynXlLJb79K29hVZlXzjACtTUxB81bqfRgA3uqYRJaJfBCubq9IOubQ_PYA7O61oPS\/s1700-nu-rw-lo-l85-e365\/canary.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjvbN8mGv2-FskUTBeR_2vt38nquYI2y2PEb7-jacaoTygZjBGaIl1VPE3anp5ujRz9vO7C-jTpBHGCyRPi9FoqwtnakLcblZDGIzppY2ZWIS2KhxzW_aNjLkl9CqPynXlLJb79K29hVZlXzjACtTUxB81bqfRgA3uqYRJaJfBCubq9IOubQ_PYA7O61oPS\/s1700-nu-rw-lo-l85-e365\/canary.png\" alt=\"\" border=\"0\" data-original-height=\"1080\" data-original-width=\"1920\"\/><\/a><\/div>\n<p>Since then, the attackers behind the campaign have switched to a two-stage process where the wget command is used to retrieve another shell script (\u00abwget.sh\u00bb) from the same server.<\/p>\n<p>Another request has been found to run wget\/curl against \u00ab<a href=\"https:\/\/www.virustotal.com\/gui\/ip-address\/45.194.90.57\/detection\" target=\"_blank\">45.194.90[.]57:38472<\/a>\u00bb to fetch a payload called \u00ab.sys_update,\u00bb save it on disk as \u00ab\/tmp\/.kworker\u00bb in an attempt to disguise it as a harmless kernel worker thread,\u00bb and then execute it. The exact functionality of \u00abwget.sh\u00bb or \u00ab.kworker\u00bb remains unknown, as they could not be retrieved.<\/p>\n<p>\u00abSeveral requests deployed no downloader at all. Instead, the flow exposes an HTTP in endpoint (for example \/cmd, or a randomly named path) wired through a function node to an exec node with addpay enabled, so the attacker could run arbitrary commands later by passing them in a query parameter,\u00bb Garrity said. \u00abThis backdoor survives even if a memory-backed implant is lost on reboot.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 03, 2026Vulnerability \/ Cyber Attack A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3933,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,104,1223,58,120,70,4022,2051,12,3102],"class_list":["post-3932","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-backdoors","tag-command","tag-critical","tag-exploit","tag-flaw","tag-iot2050","tag-plant","tag-remote","tag-siemens"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3932"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3932\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3933"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}