Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
At a glance
- Severity
- CriticalCVSS 10.0
- Used in attacks
- Not on CISA’s list
- Flaws named
- CVE-2026-58115
- Reported by
- 1 outlet
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running…
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
Vulnerabilities referenced
- CVE-2026-5811510.0Critical
Product not named yet
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
Full record →
Fastnexa security experts
Dealing with this in your own company?
If this story touches software, suppliers or systems you use, a Fastnexa security expert can tell you what it means for you and what to do first.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-11-03 05:34 UTC
Related stories
- Google Dismantles XCPE Botnet of 1.3 Million Android Devices
SecurityWeek · 2026-11-03
- Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
The Hacker News · 2026-11-03
- Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
The Hacker News · 2026-11-03
- Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
The Hacker News · 2026-11-03
- Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Krebs on Security · 2026-11-03