Critical Siemens IoT2050 flaw under active attack lets hackers plant Linux bots via Node‑RED
Attackers are exploiting CVE‑2026‑58115, a maximum‑severity bug in Siemens IoT2050 gateways, to push Linux botnet payloads and open remote command backdoors through Node‑RED. Honeypots show real‑world abuse of devices that sit between industrial equipment and the wider internet.
A critical vulnerability in Siemens IoT2050 gateways is under active exploitation, exposing networks that rely on the compact devices to connect industrial and embedded systems to the internet.
Security researchers report that attackers are abusing CVE‑2026‑58115, a flaw rated at the maximum 10.0 on the CVSS severity scale. The bug affects IoT2050 hardware that often serves as a bridge between operational technology – machines, sensors and controllers – and higher‑level IT systems.
According to analysis cited in the reporting, attackers are using the vulnerability to deploy Linux‑based botnet payloads and to create remote command backdoors via Node‑RED, a flow‑based development tool commonly used on such gateways. VulnCheck, a security firm, says it has captured exploit attempts on its honeypots, confirming that scanning and compromises are happening in the wild.
A CVSS 10.0 score typically signals that an attacker doesn’t need valid credentials and can gain broad control over the targeted device. In practice, that means someone on the internet who finds an exposed IoT2050 gateway can potentially hijack it with little effort.
Because these gateways are often embedded deep inside factories, transport systems or building automation setups, a compromised device can become a stealth entry point. Once under an attacker’s control, it can be folded into a botnet to launch further attacks, or used as a foothold to move into adjacent networks.
Organizations that have deployed IoT2050 gateways may not have them in standard IT asset inventories, especially if installation and management were outsourced. That makes it easier for vulnerable devices to remain unpatched and unnoticed even while they are being probed.
The immediate questions now are how quickly Siemens customers can identify and secure affected devices, and whether attackers stick to building large botnets or pivot toward more targeted use of compromised gateways in high‑value environments. Reports of outages, unusual equipment behavior or linked ransomware cases would show that this vulnerability is being used for more disruptive attacks, not just background scanning on the internet.
Sources
- OSINT