Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity missing authentication vulnerability, tracked as CVE-2026-58115 with a CVSS score of 10.0, impacts Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED. Unauthenticated remote attackers can exploit the unauthenticated Node-RED HTTP interface to inject malicious flows, execute arbitrary shell commands, and deploy persistent Linux botnet implants or web backdoors. Siemens addressed the vulnerability in Industrial OS version 4.3.4.1 and advises updating or removing Node-RED.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module identifies exposed Node-RED administrative HTTP interfaces and reachable web management panels on open ports, flagging unauthenticated administrative endpoints and vulnerable software banners exposed to the public internet.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain