Critical Siemens IoT Gateway Flaw Actively Exploited to Deploy Linux Bots and Remote Backdoors
Attackers are abusing CVE-2026-58115, a CVSS 10.0 vulnerability in Siemens IoT2050 devices, to install Linux bot malware and open remote command backdoors via Node-RED, according to VulnCheck data from honeypots that captured live exploit attempts.
A critical vulnerability in Siemens industrial gateways is being exploited in the wild, giving attackers a new foothold on networks that connect operational equipment to IT systems.
Security researchers have reported active abuse of CVE-2026-58115, a flaw affecting Siemens IoT2050 hardware. The bug carries the maximum Common Vulnerability Scoring System rating of 10.0, reflecting how easy it is to exploit and how severe the impact can be.
According to analysis by VulnCheck, attackers are using the vulnerability to push Linux-based bot payloads onto exposed devices and to create remote command backdoors through Node-RED, a flow-based programming tool often used on these gateways. Attempts to exploit the flaw were observed directly against VulnCheck honeypots set up to mimic vulnerable systems.
The IoT2050 family is designed to sit between industrial machinery or sensors and higher-level IT networks, collecting and forwarding data. That position makes the devices attractive targets. Once compromised, they can offer visibility into connected systems and, in some setups, a way to influence how those systems behave.
For operators, a successful attack can have several consequences. Compromised gateways can be used to move deeper into operational networks, potentially enabling disruption of physical processes or subtle manipulation of data. They can also be folded into general-purpose botnets used for tasks such as distributed denial-of-service attacks, while remaining embedded inside sensitive environments.
The use of Node-RED in the observed intrusions matters because it is often trusted to orchestrate automation tasks. An attacker who can control Node-RED flows on a gateway may be able to alter how data is handled, inject commands or hide malicious activity inside normal traffic.
The exploitation of CVE-2026-58115 shows how attackers are focusing more attention on embedded devices that bridge industrial and IT systems. These devices are often deployed widely, can be difficult to patch quickly and may not receive the same security scrutiny as traditional servers or workstations.
Signals to watch now include vendor advisories and any patches or mitigations from Siemens, evidence that this exploit is being added to common attack toolkits, and reports from operators about unusual behaviour on their edge devices. How quickly asset owners identify and secure vulnerable hardware will determine whether this flaw becomes a long-term entry point or a short-lived opportunity for attackers.
Sources
- OSINT