Siemens SIMATIC IoT2050 Node-RED CVE-2026-58115 — Active Exploitation Hunts

Threat Overview

VulnCheck observed complete exploitation requests against its honeypots starting October 30, reported November 2. Attackers created Node-RED flows that execute shell commands, download Linux bot binaries, and expose HTTP command endpoints. Honeypot exploitation does not establish production compromise.

References

Siemens SSA-834709 (August 11, 2026): https://cert-portal.siemens.com/productcert/html/ssa-834709.html ; The Hacker News (November 3, 2026): https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

Impacted Systems

SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Industrial OS with Node-RED installed, versions below V4.3.4.1; self-managed OT gateways with attacker-reachable Node-RED HTTP API. Fixed in V4.3.4.1+. Systems without Node-RED do not meet the stated affected configuration.

Why this matters

Unauthenticated remote execution can expose industrial networks and bridge OT/IT segments.

Exploitation Status

Siemens confirms the vulnerability (CVSS 10.0). VulnCheck reports exploit attempts; production victim compromise is not confirmed.

What this hunt looks for

Node-RED flow API access, observed downloader indicators, unexpected node child shells, execution from temporary directories and external payload connections.

Required logs

CommonSecurityLog, AzureDiagnostics when request fields exist, DeviceProcessEvents, DeviceNetworkEvents, Syslog.

Node-RED flow API requests

union isfuzzy=true (AzureDiagnostics | project TimeGenerated, SourceTable="AzureDiagnostics", Message=strcat(tostring(column_ifexists("requestUri_s",""))," ",tostring(column_ifexists("requestUriStem_s",""))," ",tostring(column_ifexists("requestMethod_s",""))," ",tostring(column_ifexists("clientIP_s","")))), (CommonSecurityLog | project TimeGenerated, SourceTable="CommonSecurityLog", Message=strcat(tostring(RequestURL)," ",tostring(RequestMethod)," ",tostring(SourceIP)))
| where TimeGenerated > ago(14d)
| where Message has_any ("/flows", "/cmd")
| project TimeGenerated, SourceTable, Message

Reported downloader indicators

let indicators=dynamic(["85.215.73.250","45.194.90.57","/dev/shm/.b","/tmp/.kworker","wget.sh"]);
union isfuzzy=true (CommonSecurityLog | project TimeGenerated, SourceTable="CommonSecurityLog", Detail=strcat(SourceIP," ",DestinationIP," ",RequestURL," ",Message)), (Syslog | project TimeGenerated, SourceTable="Syslog", Detail=SyslogMessage), (DeviceProcessEvents | project TimeGenerated, SourceTable="DeviceProcessEvents", Detail=ProcessCommandLine)
| where TimeGenerated > ago(30d)
| where Detail has_any (indicators)
| project TimeGenerated, SourceTable, Detail

Node spawning shell or downloader

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("node","node.exe","node-red")
| where FileName in~ ("sh","bash","dash","wget","curl","busybox","python3")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Temporary-directory execution

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any ("/dev/shm/","/tmp/")
| where ProcessCommandLine has_any (".kworker","/dev/shm/.b","wget","curl")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

Syslog fallback

Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("node-red","/flows","/dev/shm/.b","/tmp/.kworker")
| project TimeGenerated, Computer, Facility, ProcessName, SyslogMessage

Reported infrastructure connections

DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in ("85.215.73.250","45.194.90.57")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl

Detection Notes

Highest signal: exploit-specific HTTP requests plus node child shell and downloader activity. Generic /flows or shell processes may be benign. Without OT gateway HTTP logs, Linux process telemetry or network events, exploitation may be invisible. No customer Sentinel workspace was queried.