OT / ICS Security

Critical Node-RED vulnerability (CVSS 10) exploited in attacks on Siemens SIMATIC industrial gateways

CVE-2026-58115 (CVSS 10) is a lack of authentication for a critical function in the Node-RED HTTP interface. On Siemens SIMATIC IoT2050 Advanced devices with Node-RED installed, it allows an unauthenticated remote attacker to create malicious flows and execute code with the highest privileges.

  • SourceThe Hacker News
  • Source PublicationNovember 3, 2026
  • TypeThreats and Incidents

What happened

VulnCheck published exploitation observations: since October 30, 2026, honeypots have seen attempts to deploy a malicious Node-RED flow that runs automatically and downloads a bot onto Linux systems. The flow executes a shell script that downloads a binary for the AMD64 architecture from an external address, saves it in shared memory, and runs it. In a two-stage variant, an additional script is downloaded, and then the payload is saved under a name mimicking a system kernel thread.

Some requests did not download anything – instead, they created an HTTP endpoint (e.g., /cmd) linked to a command execution node, allowing commands to be run via a query parameter. Such a backdoor survives a reboot, which would otherwise remove an implant from memory. Siemens described the vulnerability in its August 2026 bulletin.

Key findings

  • Vulnerability: Lack of authentication for a critical function in the Node-RED HTTP interface (CVSS 10); affects Siemens SIMATIC IoT2050 Advanced with Node-RED.
  • Since October 30, 2026, VulnCheck honeypots have recorded ready-to-use exploits deploying a bot on Linux systems; attackers are also using a persistent command backdoor (endpoint with a command execution node).
  • Remediation: Update Node-RED to 4.3.4.1 or newer, or uninstall it; if retained – use HTTPS, editor and admin API authentication, and basic auth for HTTP nodes and the dashboard.
  • VulnCheck does not specify the number of compromised devices – these are observations from honeypots, not a measurement of total reach.

Why it matters

SafeWave CommentaryThis is exactly the scenario that justifies a separate approach to OT/ICS: an industrial gateway with a management interface exposed without authentication becomes an entry point to the network where a classic EDR agent does not work. For environments with SIMATIC IoT2050 devices and Node-RED, this is urgent: update or uninstall Node-RED, and if it must remain – enforce authentication and HTTPS, and isolate the management interface from networks where it does not need to be accessible. A backdoor that survives a reboot shows that simply restarting the device is not an adequate incident response.