Max-severity Node-RED bug exploited to deploy Linux malware in OT
Original title: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
VulnCheck documented exploitation of CVE-2026-58115 allowing unauthenticated flows to execute commands on Siemens devices.
Criminals exploit a 10/10 CVSS vulnerability in Node-RED to inject malicious flows that run shell commands. The bug affects internet-exposed industrial control systems. VulnCheck observed attacks from a Brazilian IP targeting multiple devices including Siemens SIMATIC IoT2050.
- Unauthenticated access to Node-RED HTTP interface
- Inject and exec nodes make exploitation trivial
- Targets include Apache Solr flaw CVE-2019-17558
- Malware filename indicates Linux AMD64 builds
- 1.Apply updates where available
- 2.Implement detections for Node-RED
- 3.Check if Node-RED is exposed from outside the network
- CVEs
- CVE-2026-58115
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed) | 10.0 | <1% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 4.201.105.116 | tivity observed by VulnCheck came from a single IP address, 4.201.105[.]116, which sits in Microsoft’s AS8075 network and geolocates |
| ipv4 | 85.215.73.250 | elivered a different payload pointing to a separate server (85.215.73[.]250), which VulnCheck now tracks - but doesn’t have any telem |
From the original article
3 min read at theregister.comYour industrial IoT gateway isn't exposed to the internet, right? RIGHT?!
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.