Pricing Contact Case Studies Research Talk to a Pentester ↗
POCFORGE RESEARCH 4 MIN READ Threat intel

Node-RED CVE-2026-58115 exploited in the wild: lock down unauthenticated editors on OT and IoT gateways

VulnCheck has confirmed in-the-wild exploitation of CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced gateways, from 30 October 2026. Attackers are deploying flows that drop Linux implants or leave webshells. Update to Industrial OS V4.3.4.1, enforce Node-RED admin authentication everywhere, remove internet exposure, and review deployed flows.

What changed

On 2 November 2026, VulnCheck reported that one of its canaries caught an attacker exploiting CVE-2026-58115 on 30 October 2026. The same source address hit the flaw 16 times between 30 October and 1 November, delivering several different payloads. VulnCheck has added the CVE to its own KEV catalogue; at the time of writing it is not in CISA’s KEV catalogue.

CVE-2026-58115 was published by Siemens in August 2026 (advisory SSA-834709). It carries a CVSS v3.1 score of 10.0. Affected SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface. That lets an unauthenticated remote attacker create flows that run system commands on the device with maximum privileges.

Who is affected

  • Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions before V4.3.4.1 running Industrial OS with Node-RED installed.
  • Any other Node-RED deployment running without admin authentication. The CVE is assigned to the Siemens product, but VulnCheck’s finding is broader: Node-RED instances without adminAuth configured are being found and exploited automatically. VulnCheck notes Node-RED is also used in other vendors’ ICS/OT products but has not validated whether those are affected.

What attackers are doing

VulnCheck observed attackers deploying a malicious flow in a single request, which then downloaded and ran a Linux binary from a separate payload server, stored in memory-backed temporary storage. Later requests used a staged script variant, a second payload server, and in several cases a persistent webshell built from Node-RED’s own nodes, so access survives a reboot. VulnCheck did not retrieve the binaries and makes no claims about what they do.

The activity looks like opportunistic mass scanning: the same source address hit eight different CVEs across unrelated products. That matters, because it means exposure alone is enough to be targeted.

What to do now

  1. Patch Siemens devices. Update SIMATIC IoT2050 Advanced to V4.3.4.1 or later, per SSA-834709.
  2. If you cannot patch yet, follow Siemens’ mitigations: uninstall Node-RED if it is not needed, or harden the installation following the Node-RED user guide.
  3. Enforce authentication on every Node-RED instance. Configure adminAuth in settings.js so the editor and admin API require credentials. Treat any instance without it as exposed.
  4. Remove internet exposure. Node-RED editors and admin APIs should never be reachable from the internet. Place them behind a VPN or a jump host, and segment OT gateways from corporate and external networks per Siemens’ industrial security guidance.
  5. Inventory. Find every Node-RED deployment, including those embedded in vendor appliances, Raspberry Pi devices, and containers. Shadow automation is common in OT.

How to check for compromise

  • Review deployed flows for anything you did not create, especially unexpected exec nodes, http in endpoints with unusual paths, or flows that run automatically on deploy.
  • Check the Node-RED flow revision history and logs for deployments from unknown sources since late October.
  • On the host, look for unexpected processes and hidden files in memory-backed or temporary directories, and outbound connections to unfamiliar hosts.
  • Block and hunt for the indicators VulnCheck published (source address 4.201.105[.]116; payload servers 85.215.73[.]250 and 45.194.90[.]57).
  • If you find a malicious flow, treat the device as compromised: isolate it, preserve logs, rebuild from a known-good image, rotate any credentials stored on or reachable from it, and check for lateral movement into the OT network.

PoCForge view

This is not a subtle bug. An automation editor with no login is a remote shell for whoever finds it, and attackers are now finding them automatically. In OT assessments, unauthenticated engineering and automation interfaces are among the most common high-impact findings. If you run Node-RED anywhere, confirm today that it requires authentication and is not reachable from outside your network.

Sources