Node-RED flaw CVE-2026-58115, rated CVSS 10 on Siemens SIMATIC IoT2050 Advanced, exploited to drop a Linux bot

TLDR

• VulnCheck says its canary caught an attacker exploiting CVE-2026-58115 on 30 October to download and run a Linux bot.¹
• Siemens lists SIMATIC IoT2050 Advanced below V4.3.4.1 with Node-RED installed as affected, scoring the flaw CVSS 10.0.³
• Siemens advises updating to V4.3.4.1 or later; VulnCheck and The Register say CISA's KEV did not list it yet.¹²³

Unknown criminals are exploiting CVE-2026-58115, a maximum-severity flaw involving Node-RED, a flow-based programming tool built on Node.js, to deploy a flow that downloads and runs a Linux bot, The Register reports.² VulnCheck researcher Patrick Garrity wrote on 2 November that one of the firm's canaries caught the attacker on 30 October.¹ The request was a single POST /flows from a curl/8.5.0 client, carrying a flow with an inject node set to fire once and an exec node wired to it, which ran a base64-encoded command.¹ The decoded dropper fetched a file named bot-linux-amd64 from a separate server, saved it to /dev/shm/.b and started it detached.¹ VulnCheck says it did not fetch the binary, so it cannot say what the bot does once running.¹

Siemens published advisory SSA-834709 on 11 August, covering SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices running Industrial OS with Node-RED installed, in all versions below V4.3.4.1.³ Siemens says the devices do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated remote attacker can create malicious flows and execute code with maximum privileges.³ Siemens scored the flaw 10.0 under both CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0, and classed it as CWE-306, missing authentication for a critical function.³ The National Vulnerability Database entry carries Siemens' scores.⁴ Siemens' fix is an update to V4.3.4.1 or later; its listed mitigations are to uninstall Node-RED or harden the installation as described in the Node-RED User Guide.³

The Register says Node-RED is used in commercial products including Siemens SIMATIC IoT2050 and refers to affected Siemens devices, while Siemens' advisory and the CVE record name only the IoT2050 Advanced variant.²³⁴ VulnCheck calls the issue an unauthenticated Node-RED admin API flaw and says Node-RED instances without adminAuth are being found and exploited automatically.¹ It says Emerson's documentation highlights its use of Node-RED but that it has not validated whether Emerson's products are affected.¹ Node-RED's own documentation says that by default the editor is not secured, that anyone who can reach its IP address can access it and deploy changes, and that this is only suitable on a trusted network.⁵

VulnCheck says the exploit came from one IP address in Microsoft's AS8075 network that geolocates to Brazil, which hit the Node-RED flaw 16 times between 30 October and 1 November and logged 125 hits against eight CVEs across its canary network, including Apache Solr CVE-2019-17558.¹² VulnCheck reads that as opportunistic mass scanning rather than a targeted attack and says the address says little about who is behind it.¹ In a 1 November update, it reports further payloads from the same IP, including a staged shell script, a second payload server and flows that expose an HTTP endpoint to act as persistent webshells.¹ VulnCheck says it has added the CVE to its own KEV catalogue; both it and The Register say it was not in CISA's KEV at the time of writing.¹² VulnCheck urges anyone running Node-RED, including inside OT environments, to check whether it is reachable from outside their network and to review deployed flows for unexpected exec nodes or HTTP endpoints.¹

Why it matters: a single unauthenticated HTTP request is enough to run commands on affected Siemens devices, and VulnCheck says Node-RED instances without adminAuth are being exploited automatically, so the sources point to updating, hardening Node-RED and checking external reachability.¹³