VulnCheck ma'lum qilishicha, Siemens SIMATIC IoT2050 Advanced qurilmalariga ta'sir qiluvchi maksimal darajadagi xavfsizlik zaifligi faol ravishda ekspluatatsiya qilinmoqda.
CVE-2026-58115 (CVSS balli: 10.0) sifatida kuzatilgan ushbu zaiflik — muhim funksiya uchun autentifikatsiyaning yo'qligi holati bo'lib, autentifikatsiyadan o'tmagan masofaviy hujumchi tomonidan ixtiyoriy kodni ishga tushirish uchun ekspluatatsiya qilinishi mumkin.
"Industrial OS bilan ishlaydigan va Node-RED o'rnatilgan SIMATIC IoT2050 Advanced qurilmalari Node-RED HTTP interfeysida autentifikatsiya yo'qligi zaifligini o'z ichiga oladi, bu esa autentifikatsiyadan o'tmagan masofaviy hujumchiga zararli oqimlar (flows) yaratish va asosiy serverda maksimal huquqlar bilan ixtiyoriy kodni bajarish imkonini beradi", — deb aytilgan Siemens 2026-yil avgust oyida e'lon qilgan maslahatida.
Muammo 4.3.4.1 yoki undan keyingi versiyalarda bartaraf etilgan. Yumshatish choralari sifatida Siemens foydalanuvchilarga Node-RED'ni o'chirish yoki quyidagi qadamlar orqali o'rnatishni mustahkamlashni tavsiya qiladi:
- HTTPS kirishni yoqish
- Tahrirlovchi va admin API'ni hisob ma'lumotlari asosidagi autentifikatsiya yoki OAuth/OpenID provayderi orqali himoyalash
- HTTP tugunlari va Node-RED boshqaruv panelini (Dashboard) asosiy autentifikatsiya yordamida himoyalash
2026-yil 30-oktabr holatiga ko'ra, VulnCheck hujumchilarning o'z honeypot tarmog'iga qarshi CVE-2026-58115'ni qurollantirishga urinishlarini kuzatganini, bu esa Linux botini yuklab olish va ishga tushirish maqsadida amalga oshirilganini aytdi.
"Hujumchining so'rovi to'liq ekspluat edi", — dedi VulnCheck tadqiqotchisi Patrik Garriti. "U Node-RED oqimini joylashtirdi, uni avtomatik ravishda ishga tushirdi va hujumchi nazoratidagi serverdan binarni uch qatlamli kodlash ortida yuklab oldi."
Xususan, zararli oqim qobiq skript o'ramini (shell script wrapper) ishga tushirish uchun mo'ljallangan bo'lib, u wget yordamida AMD64 arxitekturasi uchun botnet binarini [85.215.73[.]250](https://www.virustotal.com/gui/ip-address/85.215.73.250/detection) manzilidan oladi. Agar wget urinish muvaffaqiyatsiz bo'lsa, curl zaxira sifatida ishlatiladi. So'nggi bosqichda binar "/dev/shm/.b" sifatida saqlanadi va bajariladi.
Shundan beri, kampaniya ortidagi hujumchilar ikki bosqichli jarayonga o'tishdi, bunda wget buyrug'i xuddi shu serverdan boshqa qobiq skriptni ("wget.sh") olish uchun ishlatiladi.
Yana bir so'rov [45.194.90[.]57:38472](https://www.virustotal.com/gui/ip-address/45.194.90.57/detection) manziliga wget/curl orqali ".sys_update" nomli yukni olish, uni diskda "/tmp/.kworker" sifatida saqlash (bu esa uni zararsiz yadro ishchi oqimi (kernel worker thread) sifatida niqoblashga urinish) va keyin bajarish uchun topilgan. "wget.sh" yoki ".kworker"ning aniq funksionalligi noma'lum qolmoqda, chunki ular olinmadi.
"Bir nechta so'rovlar umuman yuklab oluvchini joylashtirmadi. Buning o'rniga, oqim HTTP in endpointini (masalan /cmd yoki tasodifiy nomlangan yo'l) ochadi, u funksiya tuguni orqali addpay yoqilgan exec tuguniga ulangan, shuning uchun hujumchi keyinchalik so'rov parametrida buyruqlarni uzatish orqali ixtiyoriy buyruqlarni bajarishi mumkin", — dedi Garriti. "Bu orqa eshik xotirada joylashgan implant qayta yuklashda yo'qolsa ham saqlanib qoladi."
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.
The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.
"SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges," Siemens said in an advisory released back in August 2026.
The issue has been remediated in versions 4.3.4.1 or later. As mitigations, Siemens recommends that users uninstall Node-RED or harden the installation by following the steps below -
- Enabling HTTPS access
- Securing the editor and admin API via credential based authentication or through an OAuth/OpenID provider
- Securing the HTTP Nodes and Node-RED Dashboard using basic authentication
As of October 30, 2026, VulnCheck said it observed attackers attempting to weaponize CVE-2026-58115 against its honeypot network in an attempt to download and run a Linux bot.
"The attacker's request was a complete exploit," VulnCheck researcher Patrick Garrity said. "It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding."
Specifically, the malicious flow is designed to run a shell script wrapper, which uses wget to retrieve the botnet binary for AMD64 architecture from [85.215.73[.]250](https://www.virustotal.com/gui/ip-address/85.215.73.250/detection). Curl is used as a fallback if the wget attempt fails. In the final stage, the binary is saved as "/dev/shm/.b" and executed.
Since then, the attackers behind the campaign have switched to a two-stage process where the wget command is used to retrieve another shell script ("wget.sh") from the same server.
Another request has been found to run wget/curl against "[45.194.90[.]57:38472](https://www.virustotal.com/gui/ip-address/45.194.90.57/detection)" to fetch a payload called ".sys_update," save it on disk as "/tmp/.kworker" in an attempt to disguise it as a harmless kernel worker thread," and then execute it. The exact functionality of "wget.sh" or ".kworker" remains unknown, as they could not be retrieved.
"Several requests deployed no downloader at all. Instead, the flow exposes an HTTP in endpoint (for example /cmd, or a randomly named path) wired through a function node to an exec node with addpay enabled, so the attacker could run arbitrary commands later by passing them in a query parameter," Garrity said. "This backdoor survives even if a memory-backed implant is lost on reboot."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.