Attackers exploit Node-RED CVE-2026-58115 to deploy Linux bot and backdoors
VulnCheck detects in-the-wild exploitation of CVE-2026-58115 deploying a Linux bot and webshells.
95
CVE-2026-58115
- CVSS 4.0
- 10.0 critical
- EPSS
- <1%p59
- Published
- ·
- Modified
Description · NVD
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
- Weakness
- CWE-306
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
6 storiesAttackers exploit Siemens IoT2050 missing authentication flaw
VulnCheck observed in-the-wild exploitation of CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Node-RED flows that download and run Linux bots.
90
Node-RED authentication hole being exploited in the wild
Attackers are exploiting CVE-2026-58115 to deploy flows that download and run a Linux bot on unpatched Node-RED instances.
85
Max-severity Node-RED bug exploited to deploy Linux malware in OT
VulnCheck documented exploitation of CVE-2026-58115 allowing unauthenticated flows to execute commands on Siemens devices.
80
Critical Node-RED flaw exploited in attacks
Attackers deploy Linux bots and webshells via single HTTP request; Siemens devices patched.
70
Siemens security advisory AV26-802 details control system vulnerabilities
Open source reporting indicates exploitation in the wild; users should apply updates to affected products.
60