CVE-2026-58115 Node-RED on Siemens IoT2050: exploited

Call: Patch now. CVE-2026-58115 is a CVSS 10 missing-authentication bug in Node-RED on Siemens SIMATIC IoT2050 Advanced. Siemens fixed it on Aug 11 in Industrial OS V4.3.4.1. On Oct 30, VulnCheck’s honeypots (“canaries”) caught it being exploited, and VulnCheck has added it to its own KEV list. It isn’t in CISA’s KEV yet. One HTTP request is all an attacker needs to take over the device.

What breaks: The Node-RED HTTP interface doesn’t ask for authentication. Anyone who can reach it can deploy a flow, and Node-RED’s exec node runs shell commands. Siemens says that means arbitrary code “with maximum privileges”. VulnCheck logged 16 attempts from one Microsoft-hosted IP between Oct 30 and Nov 1. Each was a single POST /flows that:

deployed a flow running a dropper for a Linux bot (/dev/shm/.b, fetched from 85.215.73[.]250:8080), or
pulled a second payload saved as /tmp/.kworker, or
left a webshell flow: an http in endpoint such as /cmd, wired to exec, that survives reboots.

The same IP was spraying old bugs in Solr, Gitea, Traefik and others. This is mass scanning, not a targeted campaign. VulnCheck’s summary is the line to remember: “Node-RED instances without adminAuth are being found and exploited automatically.”

Who’s hit: By the CVE, SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running Industrial OS before V4.3.4.1 with Node-RED installed. In practice, the attack is just Node-RED’s admin API with no login in front of it, so any Node-RED install without adminAuth reachable from untrusted networks is in the same spot. That includes the Raspberry Pi in the garage. VulnCheck notes other ICS vendors embed Node-RED but hasn’t checked whether their products are affected.

What to do:

IoT2050 Advanced: update to Industrial OS V4.3.4.1 or later. If you can’t, Siemens says to uninstall Node-RED or harden it according to the Node-RED user guide.
Any other Node-RED: set adminAuth in settings.js and keep the editor and admin API off the internet.
Check for compromise: look through deployed flows for exec nodes or http in endpoints you didn’t build. Also check for /dev/shm/.b, /tmp/.s and /tmp/.kworker, and for traffic to the IPs above. A reboot clears the /dev/shm implant but not a webshell flow.

Sources: Siemens SSA-834709 (opens in a new tab), CISA ICSA-26-237-03 (opens in a new tab), VulnCheck (opens in a new tab), The Register (opens in a new tab).

CVE-2026-58115 Node-RED on Siemens IoT2050: exploited

Sources

More from October 2026 patch cycle