CyberSecurity News

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

The Hacker News

· November 3, 2026

AI summary

A critical security flaw in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited by attackers. The vulnerability allows an unauthenticated remote attacker to run arbitrary code due to missing authentication for a critical function. This flaw has a maximum severity rating with a CVSS score of 10.0. Attackers are using the vulnerability to plant remote command backdoors. The issue is tracked as CVE-2026-58115. Siemens SIMATIC IoT2050 Advanced devices are the targets of these attacks.

Vulnerabilities mentioned

CVE-2026-58115

CRITICAL

CVSS 10

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

Read the full article at The Hacker Newsthehackernews.com/2026/11/attackers-exploit-critical-siemens.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.