Research firm VulnCheck reports that attackers are actively exploiting a critical vulnerability in Siemens SIMATIC IoT2050 Advanced devices, industrial edge computers used to connect machines and systems on factory floors. The flaw, CVE-2026-58115, carries the maximum severity score of 10.0: the Node-RED HTTP interface installed on the devices requires no authentication, letting a remote attacker run code through it with full privileges.
According to VulnCheck, the first attempts were spotted on October 30 in its honeypot network. The attackers installed Linux bots and, in some cases, left a backdoor that lets them run commands even after the device reboots.
What to do: Siemens fixed the flaw back in August, in version 4.3.4.1 and later of the operating system. Users who cannot update are advised to uninstall Node-RED or harden the installation, and not to expose the devices to the internet. It is not yet known how many devices have been compromised.