# Attackers Exploit Critical Siemens IoT2050 Bug to Install Linux Bots via Node-RED

*Tuesday, November 3, 2026 at 6:20 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-03T06:20:39.848Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22337.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A CVSS 10.0 vulnerability tracked as CVE-2026-58115 in Siemens’ IoT2050 gateway is under active attack, with researchers observing hackers using it to push Linux bot malware and create remote command backdoors through Node-RED on exposed devices.

A critical bug in Siemens’ IoT2050 industrial gateway is being actively exploited in the wild, giving attackers an easy way to drop malware and gain remote control over affected systems.

Security firm VulnCheck reports that adversaries are abusing CVE-2026-58115, a vulnerability rated 10.0 on the CVSS severity scale, in the Siemens IoT2050 platform. Honeypots set up by the company have captured live exploit attempts.

The attackers are using the flaw to push Linux bot payloads and to create remote command backdoors via Node-RED, a flow-based development tool often used on IoT devices to wire together data and control logic. With that access, an intruder can run arbitrary commands, join the device to a botnet, or use it as a foothold into attached networks.

Because the IoT2050 is deployed as a bridge between field equipment and higher-level systems, a compromise can expose both operational technology and IT assets. The combination of maximum-severity scoring and confirmed exploitation means operators using these gateways need to assume they are being scanned and, if vulnerable, may already be probed.

Key developments to watch include any updated guidance from Siemens on mitigations or patches, signs that mass-scanning botnets have incorporated the exploit, and incident reports from industrial users who find IoT2050 devices running unauthorized code.