Attackers are targeting a critical authentication flaw affecting Siemens SIMATIC IoT2050 Advanced devices in attempts to deploy Linux malware, according to VulnCheck, which detected an exploit against a canary on October 30.
The vulnerability, CVE-2026-58115, carries a CVSS score of 10.0 and affects SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed on versions earlier than 4.3.4.1. The Node-RED HTTP interface does not enforce authentication, allowing remote attackers to create flows that execute system commands with maximum privileges, Siemens says.
VulnCheck said the observed exploit deployed a Node-RED flow that triggered automatically and downloaded a Linux AMD64 bot. Researchers did not retrieve the binary, so its capabilities remain unknown.
Follow-up requests used a staged shell script and, in some cases, created HTTP endpoints wired to command-execution nodes, leaving a way to run commands later through the compromised device.
VulnCheck recorded 16 attempts from the same source IP between October 30 and November 1. Across its wider canary network, the address generated 125 hits against eight vulnerabilities, which the researchers assessed as opportunistic mass scanning rather than a targeted campaign.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
