Attackers Exploit Node-RED Auth Flaw in Siemens IoT2050 Devices
November 4: CSO Online reports exploitation persists in unpatched Node-RED instances months after Siemens fixes, noting short OT update windows and attackers using webshells instead of bots.
VulnCheck detects in-the-wild exploitation of CVE-2026-58115 in Node-RED on Siemens SIMATIC IoT2050, deploying Linux bots and webshells.
Attackers exploit a missing authentication vulnerability in Node-RED's HTTP interface (CVE-2026-58115, CVSS 10.0) to inject malicious flows that execute shell commands. The flaw affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS versions before 4.3.4.1. VulnCheck observed the attacks starting October 30, 2026, from a Brazilian IP, with payloads downloading Linux AMD64 bots via wget/curl and installing persistent webshells.
- CVE-2026-58115 enables unauthenticated RCE via Node-RED HTTP interface
- Affects Siemens SIMATIC IoT2050 Advanced with Industrial OS <4.3.4.1
- Patches released in version 4.3.4.1 or later
- Attackers deploy inject/exec nodes since October 30, 2026
- Linux bots downloaded via wget/curl; webshells for persistence
- Observed from Brazilian IP in multiple reports
Timeline
dated events in the reporting · oldest first- Oct 30, 2026VulnCheck observes in-the-wild exploitation attempts in honeypots · VulnCheck via The Register, SecurityWeek, Help Net Security, CSO Online
- Nov 1, 2026SecurityWeek notes 15 additional attacks · SecurityWeek
- Nov 3, 2026Siemens issues advisory AV26-802 update 1 · Canadian Centre for Cyber Security
- Nov 4, 2026CSO Online reports persistence in unpatched systems · CSO Online
What each outlet adds
beyond the shared facts- The RegisterDocumented Brazilian IP attacks on multiple Siemens devices
- SecurityWeek15 additional attacks by November 1; persistent webshells deployed
- Help Net SecurityCanaries caught exploit October 30; bot-linux-amd64 downloads
- CSO OnlineUnpatched instances despite months-old fixes; short OT update windows
- CVEs
- CVE-2026-58115
Coverage
oldest first · one row per article · UTC- · 1d ago
The Register · SecurityFirst report
Max-severity Node-RED bug exploited to deploy Linux malware in OT
VulnCheck documented exploitation of CVE-2026-58115 allowing unauthenticated flows to execute commands on Siemens devices.
- · 23h ago
The Hacker News
Attackers exploit Siemens IoT2050 missing authentication flaw
VulnCheck observed in-the-wild exploitation of CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Node-RED flows that download and run Linux bots.
- · 16h ago
SecurityWeek
Critical Node-RED flaw exploited in attacks
Attackers deploy Linux bots and webshells via single HTTP request; Siemens devices patched.
- · 16h ago
Help Net Security
Attackers exploit Node-RED CVE-2026-58115 to deploy Linux bot and backdoors
VulnCheck detects in-the-wild exploitation of CVE-2026-58115 deploying a Linux bot and webshells.
- · 14h ago
Canadian Centre for Cyber Security
Siemens security advisory AV26-802 details control system vulnerabilities
Open source reporting indicates exploitation in the wild; users should apply updates to affected products.
- · 1h ago
CSO Online
Node-RED authentication hole being exploited in the wild
Attackers are exploiting CVE-2026-58115 to deploy flows that download and run a Linux bot on unpatched Node-RED instances.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed) | 10.0 | <1% |