VulnCheck disclosed on November 2 that attackers are actively exploiting CVE-2026-58115, a CVSS 10.0 flaw in the Node-RED deployment shipped on Siemens SIMATIC IoT2050 Advanced industrial gateways. Its honeypots recorded complete exploit chains starting October 30, 2026, nearly three months after Siemens published its fix.

What happened

Siemens advisory SSA-834709 (published August 11, 2026) covers SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, in all versions before V4.3.4.1. On affected devices the Node-RED HTTP interface does not require authentication. Node-RED exposes programming nodes, such as exec, that run system commands, so anyone who can reach the editor or its admin API can run code on the gateway with the highest privileges.

This is an insecure-default deployment problem on the Siemens image, not a bug in the upstream node-red npm package. No upstream Node-RED release “fixes” it. The same condition, however, applies to any Node-RED instance that is exposed without adminAuth configured.

Technical details

  • Vector: network, no privileges, no user interaction (CVSS 3.1 10.0).
  • Attack chain: a single request deploys a malicious flow. The flow executes automatically and fetches a Linux bot binary from attacker-controlled infrastructure. VulnCheck did not retrieve the binary, so post-launch behavior is unknown.
  • Persistence: in a second variant, attackers planted a webshell as part of the flow itself. Because Node-RED stores flows on disk and reloads them at start, the backdoor survives a reboot.
  • Timeline: Siemens advisory August 11; first observed exploitation October 30; VulnCheck disclosure November 2. Reports differ on KEV status: VulnCheck lists the CVE in its own KEV catalog, and one source said it was not in CISA’s catalog as of November 3.

Exploitation requires nothing more than reaching the Node-RED port, so the practical question is exposure. Internet-facing Node-RED editors are a long-standing target for botnet operators, and industrial gateways are frequently placed on routable addresses for remote maintenance.

Impact

IoT2050 gateways bridge OT networks to IT and cloud services. A compromised unit gives an attacker root on a device that typically holds credentials for PLCs, MQTT brokers, and cloud connectors, and a pivot point into the plant network. Bot deployment means devices may also be conscripted for DDoS or proxying. A device that has been rebooted since compromise is not clean if the malicious flow persisted.

Mitigation

  1. Update affected devices to Industrial OS V4.3.4.1 or later, per SSA-834709.
  2. Remove the Node-RED editor from any untrusted network. Put it behind a VPN or an authenticated reverse proxy, and never expose ports 1880 or the admin API directly.
  3. On any Node-RED instance, set adminAuth in settings.js and require credentials for the editor and admin API.
  4. Hunt for compromise: review deployed flows for unfamiliar exec, http request, or function nodes, check for flow files modified since October 30, and inspect outbound connections to unknown hosts and unexpected binaries in writable directories such as /tmp.
  5. If a flow-based backdoor is found, treat the device as fully compromised: reflash, rotate every credential and token stored on it, and review adjacent systems.

References