Critical Node-RED flaw exploited in attacks
Original title: Critical Node-RED Flaw Exploited in Attacks
Attackers deploy Linux bots and webshells via single HTTP request; Siemens devices patched.
VulnCheck reports successful in-the-wild exploitation of a critical missing authentication vulnerability in Node-RED. The flaw, tracked as CVE-2026-58115, allows unauthenticated remote code execution on the HTTP interface. Attackers observed deploying Linux bots and persistent webshells since October 30 from a Microsoft network IP. Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED are affected; version 4.3.4.1 and later contain patches.
- Observed 15 additional attacks by November 1
- Payloads include persistent webshells
- Attackers scan for Node-RED instances without adminAuth
- Exploitation via single HTTP request
Impact: unauthenticated remote code execution
- 1.Update to Node-RED version 4.3.4.1 or later
- 2.Check if Node-RED is reachable from outside the network
- 3.Review deployed flows for unexpected exec nodes
- CVEs
- CVE-2026-58115
- Vendors
- Siemens
- Products
- Node-REDSIMATIC IoT2050 Advanced
- Malware
- Linux bot
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed) | 10.0 | <1% | PoC |
From the original article
2 min read at securityweek.com
Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells. The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.