VulnCheck says attackers exploited unauthenticated Node-RED flaw CVE-2026-58115, using malicious flows to deploy Linux bots and persistent webshells. Siemens…

VulnCheck observed attempts to exploit CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Linux payloads and Node-RED command backdoors…

On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot. The request cam...

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running

VulnCheck's Initial Access Intelligence team details an unauthenticated pre-auth remote root RCE chain in Control Web Panel, where the user panel emits its login redirect without stopping execution, s...

Initial Access Exploits and Associated Artifacts. Contribute to vulncheck-oss/initial-access-community development by creating an account on GitHub.

VulnCheck detected attempts to exploit a CVSS 10.0 Node-RED flaw in Siemens SIMATIC IoT2050 devices to deploy a Linux bot.

Aanvallers infecteren servers met malware via een kritieke kwetsbaarheid in Node-RED, meldt Security.nl op basis van informatie van beveiligingsbedrijf Vulncheck.

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running

## 1. Overview * Article Title: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products * Source: VulnCheck * Published Date: 2026-11-02 * Original: VulnCheck * Related Sources: Siemens SSA-834709, SecurityWeek: Critical Node-RED Flaw Exploited in Attacks, Node-RED: Securing Node-RED * Associated Malware: Unretrieved Linux bot payload * Threat Actors: Unattributed * Associated CVE: CVE-2026-58115 * Related Products: Node-RED; Siemens SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed (the officially affected configuration) * Severity: critical ## 2. Executive Summary Security firm VulnCheck reported observing active attack requests attempting to deploy Linux binaries or persistent webshells by automatically executing OS commands via a single `POST /flows` request, targeting a vulnerability (CVE-2026-58115) that allows unauthenticated deployment of Node-RED flow definitions. However, the observation was made against a honeypot (canary environment) operated by VulnCheck; successful compromises in production industrial control and IoT systems, as well as the specific functionalities of the unretrieved payloads, have not been confirmed. Automated scanning exploiting paths leading to unauthenticated remote code execution has been observed, with a single source IP conducting broad scans across multiple vulnerabilities. While official impact has been confirmed for Siemens SIMATIC IoT2050 Advanced Industrial OS with embedded Node-RED, whether this CVE number applies under the same conditions across other vendor hardware or standalone Node-RED environments requires individual verification. ## 3. Attack Flow Several variants of the observed attack requests exist, structured based on flow definitions sent to the canary environment. Attack Variant | Initial Request | Execution Mechanism | Prerequisites and Characteristics ---|---|---|--- Variant A: External Downloader Type | Single `POST /flows` | An inject node triggers an exec node one second after deployment, executing a Base64-decoded shell command | Requires `wget` or `curl`, write and execution permissions in `/dev/shm` or `/tmp`, and outbound communication to an external payload server Variant B: HTTP In Webshell Deployment | Single `POST /flows` | Creates a new HTTP In endpoint, registering a flow that passes input queries through a function node to an exec node | Does not require downloading external binaries; commands can be launched with Node-RED's OS privileges if the deployment creates a reachable HTTP endpoint. Preservation and removal of stored malicious flows are also necessary ### Procedure from Single POST to Payload Execution and Webshell Deployment 1. **Management API Discovery and Request Submission** : An attacker scans for unprotected Node-RED management APIs exposed on the internet and sends a `POST /flows` containing a crafted JSON flow definition. 2. **Execution Trigger Branching** : In the downloader type, an inject node (`once: true`) sends a message one second after deployment, triggering the Base64-decoded shell execution embedded in the exec node command field. The webshell type does not require an inject node, instead using subsequent HTTP requests as execution triggers. 3. **Command Execution and Subsequent Deployment** : * **Downloader Type** : The downloader decodes the Base64 string and pipes it to `sh`. Depending on the variant, the command fetches and runs a Linux binary at `/dev/shm/.b`, a different payload at `/tmp/.kworker`, or the staged shell script `wget.sh` at `/tmp/.s` (executed with `sh`). * **Webshell Type** : Registers a new HTTP endpoint and operates a flow that executes parameters included in external web requests directly as OS commands. ## 4. Attacker Position and Execution Location * The attacker sends requests from an external network with HTTP access to Node-RED's management port (default 1880, etc.). Additional payloads are downloaded from a separate attacker-controlled server. ## 5. Perspective of Victims and Administrators ### Victim * General OT and industrial automation personnel may not notice anomalies immediately; impacts may surface as increased CPU load on devices, unknown external traffic, or malfunctions in automation processes. ### Administrator * Observable indicators include `POST /flows` entries in Node-RED access logs, unexpected flow revision updates, the addition of unknown inject, exec, or http in nodes, hidden files created in `/dev/shm` or `/tmp`, and HTTP traffic destined for external IPs. ## 6. Success and Failure Conditions ### Success Conditions * The attacker has direct network access to the Node-RED management API, and authentication mechanisms such as `adminAuth` are not configured or are misconfigured, permitting flow modifications. * The Node-RED process can launch an OS shell via the exec node. The downloader type requires outbound communication and execution permissions in specific directories, whereas the webshell type does not require outbound communication to fetch external payloads, but does require the attacker to reach the HTTP endpoint. ### Failure Conditions and Mitigations * Remove public internet exposure of the Node-RED editor and admin API. Enable authentication with `adminAuth`, and separately restrict network access with IP allowlists. * Update Siemens SIMATIC IoT2050 Advanced Industrial OS to the patched version (v4.3.4.1 or later). * Minimize Node-RED execution user privileges, restrict unnecessary use of exec nodes, writable directories, and outbound communication, and detect unknown flows by diffing against legitimate definitions. * Note that while `adminAuth` protects editors and management APIs, authentication for already deployed HTTP In endpoints must be managed separately. Malicious flows must be completely removed, and authentication settings on HTTP nodes must also be verified. ## 7. What Happens Upon Success * Arbitrary OS command execution under the Node-RED process execution privileges (root in some environments). * Retrieval and execution of external Linux payloads. Specific functionalities remain unconfirmed as payloads were not retrieved. * Establishment of a persistent webshell via HTTP endpoints on Node-RED. ## 8. Observable Logs Inference: The following outlines potential log sources to investigate within your organization. This depends on log collection and retention settings and does not imply that all log outputs were confirmed in the primary source. * **Email** : No observations specific to this incident in the primary source. * **Proxy / SWG / DNS** : Management port access from source IPs identified during investigation (e.g., `4.201.105.116`), and traffic destined for payload delivery servers (`85.215.73[.]250:8080`, `45.194.90[.]57:38472`). * **Endpoint / EDR** : Process clusters where Node.js processes spawn `sh`, `wget`, `curl`, `chmod`, `setsid`, and `nohup`. Suspicious executables such as `/dev/shm/.b` or `/tmp/.kworker`. * **Identity / IdP** : Unknown sessions or login attempts in environments with authentication enabled. In unauthenticated environments, the absence of authentication logs itself becomes a blind spot. * **SaaS / Cloud** : Security group and firewall rule change histories for cloud-hosted Node-RED instances. * **Network** : Outbound HTTP traffic immediately following `POST /flows` requests, and requests destined for unknown HTTP In endpoints. ## 9. Attack Success Assessment ### Attack Attempt Observed (Success Unconfirmed) * **Assessment Stage** : Attack Attempt Observed (Success Unconfirmed) (`contact_only`) / Scope: VulnCheck canary environment telemetry * **Basis** : VulnCheck's honeypot received attack requests and returned successful responses (HTTP 200), but there is no evidence of OS commands executing on production industrial equipment or confirmed payload infection facts, so it is not assessed as successful. ## 10. Investigation Playbook Inference: The following is an incident investigation procedure for your organization. ### Trigger * Initiated by suspicious `POST /flows` requests targeting Node-RED, unexpected flow updates, or the detection of shells and download tools spawned from Node.js processes. ### Initial Triage * Verify source IPs, receipt timestamps, HTTP bodies (injected flow definitions), response codes, flow revisions, running Node-RED versions, and `adminAuth` configuration status. ### Endpoint * Preserve the process tree of the Node-RED host, stored `flows.json`, suspicious files in `/dev/shm` and `/tmp`, network sockets, and memory dumps. ### Identity / Cloud * Inspect reverse proxy configurations, cloud security groups, and management account authentication logs. ### Subsequent Compromise * Track access to deployed webshell endpoints, internal network scans, and whether abnormal commands were sent to industrial control (OT) protocols. ### Containment * Immediately restrict network access to the management ports. Preserve malicious flow definitions and related logs, then disable and remove the malicious flows while retaining the evidence. Restore legitimate flows from known-good backups, isolate the host, and apply patches. ### Assessment * Evaluate and separate the stages of scan contact, flow deployment, command invocation, payload retrieval, and webshell exploitation. ## 11. Defense and Detection Ideas ### Single Event Detection * Detect `POST /flows` requests from external networks that include `exec` nodes or `inject` nodes with `once: true` within flow definitions. ### Timeline Correlation * Perform timeline correlation analysis on flow definition updates, child process creation from Node.js, HTTP connections to external IPs, and the creation of unknown HTTP listeners. ### Threat Hunting Perspectives * Search all Node-RED environments within the organization for unauthenticated management consoles, usage of `exec` nodes, wired connections leading directly from HTTP In to exec, and known IOC files. ### Logging Blind Spots * In the absence of flow modification audit logs or reverse proxy access logs, it becomes difficult to retrospectively prove who injected what flows and when. ### Priority Mitigations * Prioritize hiding management interfaces from the public internet, enabling `adminAuth`, applying patches to embedded products such as SIMATIC IoT2050, and minimizing execution privileges. ## 12. Facts, Inference, and Hypothesis ### Facts * On October 30, 2026, VulnCheck observed unauthenticated `POST /flows` requests targeting CVE-2026-58115 in its canary environment, confirming 16 related events from the same IP by November 1. * Attack requests included complete flow definitions designed to decode Base64 commands and pass them to a shell one second after deployment, utilizing `wget` or `curl` to fetch and execute Linux binaries. * The same source IP conducted a total of 125 access attempts across eight different CVEs including Node-RED, exhibiting characteristics of indiscriminate mass scanning covering both old and new vulnerabilities. * Additional requests included those deploying alternative payloads (`.kworker`) and registering webshell-type flows that accept arbitrary OS commands via query parameters. * VulnCheck was unable to retrieve or analyze binaries, `wget.sh`, or `.kworker`, and specific functionalities such as reverse shells, miners, or DDoS bots remain unidentified. * Siemens advisory (SSA-834709) targets SIMATIC IoT2050 Advanced Industrial OS versions prior to 4.3.4.1 with embedded Node-RED, urging updates to that version. ### Inference * Inference: Because different payloads and User-Agents are sent from the same IP, it is highly likely that shared, rented, or compromised scanning infrastructure is being abused rather than infrastructure dedicated to a single attacker. * Inference: Files placed in `/dev/shm` disappear upon reboot, but webshells registered as flow definitions persist after reboot; therefore, the absence of files alone does not rule out a compromise. ### Hypothesis No additional hypotheses. Unconfirmed items are noted in "Unknowns and Limitations". ## 13. MITRE ATT&CK Mappings ID | Technique | Confidence | Basis ---|---|---|--- T1190 | Exploit Public-Facing Application | high | Observed attack requests sending `POST /flows` to unauthenticated Node-RED management APIs to deploy command execution nodes. T1059.004 | Unix Shell | high | Confirmed commands piping Base64 decode results to `sh` for downloading, permission changing, and background execution. T1105 | Ingress Tool Transfer | high | Confirmed requests fetching Linux binaries from external servers using `wget` or `curl`. T1505.003 | Web Shell | high | Observed webshell-type flows directly connecting HTTP In nodes to exec nodes to execute remote commands via URL parameters. ## 14. Unknowns and Limitations * Although the canary environment returned successful responses, no individual victim cases where payloads successfully executed in production Node-RED environments have been publicly reported. * The functionalities of unretrieved binaries, the identities of threat actors, and the existence of victim organizations remain unknown. * The official scope of the CVE is Siemens SIMATIC IoT2050 Advanced (prior to 4.3.4.1) running Industrial OS with Node-RED. Whether this CVE number applies uniformly to other vendor products or standalone Node-RED environments requires verification with each vendor. ## 15. Impact on SOCs and Organizations Organizations operating Node-RED or SIMATIC IoT2050 in manufacturing, infrastructure facilities, building automation, and other sectors must urgently inspect whether management interfaces are inadvertently exposed to the internet and ensure that `adminAuth` is properly configured. It is important to note that automated attack requests complete in a single POST, and establishing monitoring to detect suspicious requests to management APIs as well as the unauthorized addition of exec or HTTP In nodes within flows is critical. ## 16. Summary by Target * **SOC** : Monitor for `POST /flows` occurrences, unauthorized additions of exec nodes, communications destined for payload servers, and hidden files in `/dev/shm` or `/tmp`. * **Administrators** : Restrict management ports to internal closed networks, enable `adminAuth`, and apply Siemens product patches (v4.3.4.1 or later). * **Users** : Report unexpected automation behaviors or flow modifications promptly to system administrators.

Exploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The exploit intelligence company, delivers structured exploit intelligence on what is actively we…

The Register, publié le 2 novembre 2026. L'information est basée sur un advisory publié par VulnCheck (chercheur Patrick Garrity) le même jour, faisant suite à la détection d'une exploitation active observée à partir du 30 octobre 2026.

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that…

A VulnCheck canary has caught the first live exploitation of CVE-2026-58115, an unauthenticated Node-RED admin API flaw exploited to drop Linux bots.

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running

Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild. The problem involves open source IoT/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs. Security firm VulnCheck discovered the exploits and disclosed details in a blog post on Monday. “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot. The request came from an IP in Microsoft’s ASN (AS8075),” the post said. “We have since seen 16 events from the same IP against this CVE, covering several different payloads.” The core problem is that Node-RED ships with the authentication option disabled; users are supposed to change the setting before it goes live. Patrick Garrity, the VulnCheck security researcher who wrote the post, said the fact that Node-RED deployments are popular among those outside IT makes them susceptible to unsophisticated errors like this. “They are put in place by relatively nontechnical people,” Garrity said in an interview. Aman Mahapatra, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the Node-RED hole is not new, but it is still being leveraged in the wild. “The condition being exploited is one Node-RED has carried for years as a default: unless an administrator configures authentication, anyone who can reach the editor can deploy flows, and the project’s own documentation says as much,” he said. “Node-RED is popular precisely because engineers can wire it up without involving IT, which also means it rarely appears in an asset inventory. It is the same pattern behind this week’s supermarket refrigeration attacks: equipment installed outside the security team’s view, reachable from the internet, with authentication switched off.” Mahapatra pointed out that the biggest danger is the nature of the way users tend to deploy Node-RED. “It is integration middleware. A typical deployment speaks Modbus, OPC UA, MQTT or S7 to controllers on one side and to databases, brokers and cloud services on the other, and it stores credentials for all of them,” he said. “A compromised instance is a credential vault for every system it touches and a bridge across an IT/OT boundary that the network diagram says does not exist.” Another problem is that industrial system patches tend to happen on pre-planned schedules, rather than responding to emergent issues or suggested setting changes. “Siemens published its advisory on August 11, and VulnCheck caught exploitation on October 30, three days after shipping its own detections,” Mahapatra said. “Eleven weeks is a short runway in OT, where firmware updates wait for planned maintenance windows, so a meaningful share of affected gateways will remain unpatched well into next year.” Frank Dickson, principal analyst at Dickson Research, added that the details of the exploits are a good news/bad news situation for CISOs. The good news is that the attacks did not appear to have targeted industrial systems. The bad news is the attackers found and accessed those systems anyway. Noah Kenney, principal consultant at Digital 520, agreed. “They don’t necessarily need to understand the equipment or operations connected to these gateways. They’re simply looking for systems capable of executing their commands,” he said. “That creates a concerning possibility where industrial operations could be disrupted by attackers who never intended to target critical infrastructure in the first place. Even generic malware consuming system resources or interfering with network communications could have operational consequences.” Dickson added that closing this hole may not resolve the exposure. “The report also found that some attackers skipped the bot and left web shells, hidden back doors for running commands later,” Dickson said. “Patching closes the door. It does not evict anyone already inside.”

There is an active exploit of a critical security vulnerability in Node-RED by threat actors to install malicious Linux bots and webshells on vulnerable systems. It is believed that the attacks, detected by cybersecurity firm VulnCheck, could result in compromised instances and industrial environments being exposed to remote command execution and unauthorized access.  Tracked as CVE-2026-58115, the vulnerability has a CVSS severity rating of 10.0. Node-RED HTTP interface does not contain authentication, allowing remote attackers to access programming functions and execute system commands on the underlying server if unauthenticated remote attackers are not authenticated.  A browser-based editor enables users to build event-driven applications using Node-RED, an open-source, flow-based programming tool. It is widely used in industries including manufacturing, healthcare, home automation, and industrial control systems. A number of Siemens IoT2050 Advanced devices have been integrated with the platform, including Siemens SIMATIC IoT2050 Advanced devices. Siemens disclosed the vulnerability on August 11, 2026, after identifying the issue with SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. In order to take advantage of this vulnerability, attackers could create malicious programming flows and execute arbitrary code with maximum privileges if it is successfully exploited. A fix for the vulnerability is available in Siemens SIMATIC IoT2050 Advanced version 4.3.4.1 and later. Although security updates have been available, attackers continue to target vulnerable instances. A malicious request containing a complete exploit was captured by one of VulnCheck's monitoring systems on October 30, when it was detected as successful exploitation. This attack deployed a Node-RED flow, triggered its execution automatically, and downloaded a binary from a server controlled by the attacker.  A malicious execution flow was initiated using Node-RED components, including the inject and execute nodes, without requiring additional interaction from the attacker. There has been no indication of the exact purpose of the downloaded binary, identified as bot-linux-amd64, which was stored under a hidden filename in a memory-backed location and executed in the background.  Researchers were unable to retrieve the binary for further examination. During the exploitation campaign conducted between October 30 and November 1, repeated attempts were made from the same IP address. The attack vectors used by VulnCheck are 16 attempts to exploit CVE-2026-58115, with attackers delivering a variety of payloads across multiple requests.  The address used by the attackers originates from Microsoft's AS8075 network, which is located in Brazil. A researcher cautioned that the use of cloud providers' networks does not necessarily identify threat actors, since such infrastructure may include virtual machines rented or compromised by cloud providers. Other attempts were made to install webshells, which gave attackers access to compromised servers and the ability to execute commands remotely, in addition to deploying Linux bots. In some instances, additional shell scripts and files appeared to be legitimate Linux kernel processes. As opposed to the originally observed bot, which was stored in memory and could be removed when the system was rebooted, the webshells provided a more persistent method of access. In addition to identifying broader scanning activity from the same IP address, VulnCheck also recorded 125 requests targeted at eight different vulnerabilities affecting Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla.  A survey of Node-RED installations indicates opportunistic mass scanning rather than activity concentrating exclusively on Node-RED installations Security experts have expressed concerns about the vulnerability of industrial environments through poorly secured Node-RED deployments.  Industrial controllers are often integrated with databases, messaging systems and cloud services through this platform, allowing the platform to hold credentials for multiple connected systems. Consequently, a compromised instance could give attackers access beyond the initial server and facilitate movement across networks in the areas of information technology and operational technology. It is also important to note that Node-RED deployments are not always managed by dedicated IT security teams, increasing the risk.  It is common for engineers and operational staff to configure Node-RED installations directly, thus preventing regular asset inventories and security monitoring. Additionally, scheduled maintenance requirements can delay firmware updates in industrial environments, resulting in vulnerable devices remaining exposed even after patches have been released. CVE-2026-58115 has been added to VulnCheck's Known Exploited Vulnerabilities (KEV) catalog in response to the observed attacks. When reported, this vulnerability was not listed in CISA's KEV catalog. It is recommended that organizations using Node-RED apply security updates, enable authentication via the adminAuth setting, and restrict external network access to the editor.  The security team should also examine deployed flows for unanticipated executable nodes, unauthorized HTTP endpoints, and suspicious file modifications. It is equally important to examine system logs and outbound network connections for signs of compromise, as installing patches alone may not remove webshells or other malicious components already present on the system. Node-RED deployments exposed to industrial environments may pose security risks resulting from the active exploitation of CVE-2026-58115. It is recommended that organizations prioritize patching, enforce authentication, limit access to the editor and investigate for signs of compromise. In light of the possibility of existing webshells remaining after updates have been applied, security checks should accompany remediation efforts as well.