A CVSS 10.0 Node-RED flaw in Siemens SIMATIC IoT2050 gateways has been exploited since 30 October 2026. The patch has been available for months; the real risk sits in field devices nobody has inventoried.
A maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced industrial gateways is now being exploited in the wild. Tracked as CVE-2026-58115 and rated 10.0 on the CVSS scale, the issue comes down to the Node-RED flow management interface running on these devices being reachable without any authentication.
Security research firm VulnCheck reported on 2 November 2026 that it first saw attack attempts against its honeypot sensors on 30 October 2026. The attack needs nothing more than a single HTTP request: the attacker pushes their own flow to the device, it fires within seconds and runs commands on the underlying operating system. According to VulnCheck, the earliest wave pulled down a memory-resident bot binary, while later attempts dropped a persistent web shell. That backdoor survives a reboot even when the in-memory payload does not.
Why it matters
What makes this dangerous is not the score but how little the attack requires. There is no need for a custom exploit kit, user interaction or a previously stolen account — network reach to the management interface is enough. And the problem is not limited to Siemens hardware: any Node-RED instance deployed without adminAuth enabled carries exactly the same exposure.
Siemens published its advisory back in August 2026 and shipped the fix in Industrial OS V4.3.4.1. In other words, attackers are working through a hole that has had a patch available for months. It is a familiar pattern: patch cycles for OT and IoT equipment move far slower than they do for office servers.
What this means for businesses in Türkiye
Industrial gateways like the IoT2050 sit in manufacturing plants, workshops in industrial estates, logistics warehouses and building automation cabinets, collecting machine data and feeding it into reporting systems. They are usually installed and commissioned by a systems integrator, and after that they quietly disappear from everyone's asset list. A production line that keeps running is not evidence that the device behind it is up to date.
The second risk is where these devices sit on the network. Exposing the management interface straight to the internet for convenient remote monitoring, or leaving the production network on the same segment as the office network, is still common practice. A compromised gateway then stops being a sensor box and becomes a doorway into the corporate network.
For a manufacturing SME the first loss is usually downtime rather than leaked data: line telemetry stops, reporting breaks, sometimes the production schedule slips. If the device touches personal data — badge readers or camera integrations, for instance — the same incident can also turn into a reportable breach under Türkiye's data protection law. Industrial equipment belongs in the IT asset inventory, not in a separate category nobody reviews.
What does Kamer Bilişim recommend?
- Build the inventory first. List every industrial gateway, edge PC and Node-RED installation on site, and record its version, the integrator responsible for it and its patch status. You cannot protect a device you cannot see.
- Take management interfaces off the internet. Do not leave the Node-RED editor or admin API publicly reachable; if remote access is required, put it behind a VPN. Where you cannot patch immediately, at minimum enable adminAuth authentication or remove Node-RED from the device.
- Segment the production network and watch it. Move OT devices onto a separate VLAN and allow only the traffic they actually need through the firewall. Restricting outbound connections from these devices means that even a successfully planted backdoor struggles to reach its command server.
If you would like help building an inventory of the industrial devices on your site, reviewing your network segmentation or going through your firewall rules together, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: The Hacker News, Securityonline.info, VulnCheck
Source: The Hacker News