One web request is enough to hack unpatched Siemens industrial devices

No password needed. To take control of certain Siemens industrial devices, a single web request is enough, and bots have been using it since at least October 30. That day, a VulnCheck decoy server, set up to observe attackers, recorded a complete attack. The attacker drops a small program into Node-RED and triggers it immediately. The program downloads a file named bot-linux-amd64, stores it in memory and runs it.

The flaw, CVE-2026-58115, is rated 10 out of 10. It affects SIMATIC IoT2050 devices running Industrial OS with Node-RED installed, a visual programming tool that connects sensors, machines and online services. Siemens disclosed it on August 11. Version V4.3.4-1 fixes it. On November 4, the manufacturer revised its advisory: it now lists four models, the IoT2050 Advanced, Basic, M.2 and SM.

An administration door open to everyone

According to Siemens, these devices require no authentication on the Node-RED web interface. Yet the tool contains blocks capable of running system commands. A remote attacker with no account could therefore run their own code with the highest privileges. The Node-RED documentation says it plainly: by default, the editor “is not secure.” That setting is only suitable for a trusted network.

Bots sweeping the Internet

Between October 30 and November 1, VulnCheck counted 16 attempts from a single IP address on Microsoft's network, located in Brazil. The payloads varied: a download script, a second server, and web backdoors left in place. VulnCheck did not recover the programs and says nothing about their capabilities. The same address targeted eight flaws in software as different as Gitea, Joomla and Apache Solr. VulnCheck sees this as the signature of opportunistic mass scanning: Node-RED instances without administration protection “are found and exploited automatically.” The flaw was not yet in the catalog of CISA, the US cybersecurity agency, at the time of this analysis.

What to do

As with supermarket refrigerators, where weak passwords were enough according to ANSSI (France's national cybersecurity agency), the danger comes from an access left open, not from technical prowess.

• Update the IoT2050 devices to version V4.3.4-1 or later.
• Failing that, uninstall Node-RED or harden it following the project's guide, and filter network access to the devices, as Siemens recommends.
• Check that no Node-RED instance is reachable from the Internet, including those embedded in other vendors' equipment.
• Enable administration protection (adminAuth) with hashed passwords, and switch to HTTPS.
• Review the deployed programs and look for any command-execution block or unexpected web entry point.

One question remains: how many other industrial devices ship with Node-RED and no password? VulnCheck cites Emerson documentation that mentions it, without having checked whether its products are affected.