What Happened
Attackers are exploiting CVE-2026-58115, a Siemens IoT2050 vulnerability rated CVSS 10.0, The Hacker News reports. The flaw is a missing authentication check in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running Industrial OS. Remote attackers need no credentials. They create a malicious flow and run code with maximum privileges.
VulnCheck saw the activity on its honeypot network as of October 30. Early attacks pulled down a Linux botnet binary and ran it from memory. Later attacks fetched a second-stage script and installed an HTTP endpoint wired to a command-execution node. This backdoor survives reboots. Siemens published advisory SSA-834709 in August, so the fix has been available for months.
Why This Matters for Canadian Organizations
The IoT2050 is an industrial gateway. Manufacturers, utilities, and water and energy operators use devices like it to bridge plant networks and IT systems. A gateway with a perfect-score flaw gives an attacker a foothold next to operational technology.
Canadian operators in these sectors are a stated priority for the Canadian Centre for Cyber Security, which has warned about threats to critical infrastructure for years. Many plants run gateways for a decade without a firmware review. Exposed Node-RED interfaces are easy for scanners to find, and the botnet payload shows criminals already automate the search. For regulated utilities and federally regulated firms, an unpatched, internet-reachable gateway also raises questions under OSFI B-13 expectations and provincial reliability rules.
Our TechTalk coverage shows how often old advisories turn into new compromises.
What to Do
Inventory every IoT2050 and every Node-RED instance on your plant and edge networks. Update to the fixed Industrial OS release named in SSA-834709. Remove Node-RED where you do not need it. Where you must keep it, enable HTTPS and require credentials for the editor, the admin API, HTTP nodes, and the dashboard. Block internet access to these interfaces. Hunt for /dev/shm/.b, /tmp/.kworker, and unknown flows with HTTP endpoints. Rebuild any device with signs of compromise. For more daily coverage, see our latest news.
