Patch and Lock Down Node-RED as Attackers Exploit Admin API Flaw

Node-RED installations that run without a login are now being exploited in the wild through CVE-2026-58115. The fix is to update affected Siemens SIMATIC IoT2050 Advanced devices to V4.3.4.1 or later, switch on the editor’s built-in authentication and take it off the public internet. Security firm VulnCheck said its canary systems caught the first exploitation attempt on 30 October 2026.

The flaw carries the maximum CVSS 3.1 score of 10. According to the Siemens advisory republished by CISA, it lets an unauthenticated remote attacker create malicious flows and “execute arbitrary code on the underlying server with maximum privileges”.

How to fix and harden Node-RED now

The advisory covers SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) below V4.3.4.1, running Industrial OS with Node-RED installed. Siemens ProductCERT first published it on 11 August, and CISA republished it on 25 August. It offers three remedies:

• Update to V4.3.4.1 or later, using Siemens’ industry support download.
• Harden the installation by following the project’s user guide.
• Uninstall the software if the device has no use for it.

The project’s security guide explains how to harden it. The editor and Admin API support a username and password login, or sign-in through an OAuth or OpenID provider. You turn this on with the adminAuth property in the settings file.

CISA’s standard advice also applies: keep control system devices off the internet, put them behind firewalls, and use a VPN when remote access is needed.

VulnCheck suggests two quick checks:

• Exposure: find out whether a Node-RED instance can be reached from outside your network.
• Flows: review the deployed flows for exec nodes or HTTP endpoints that nobody on your team added.

Defenders can also look for its published payload servers, 85.215.73[.]250:8080 and 45.194.90[.]57:38472, and for a file written to /dev/shm/.b.

What the attack looked like

VulnCheck described a single POST /flows request sent with the curl/8.5.0 user agent. The request deployed an inject node set to fire once after a one-second delay, wired to an exec node. The exec node ran a base64-encoded dropper. It used wget or curl to fetch a file called bot-linux-amd64 into /dev/shm/.b, made it executable and launched it in the background.

In an update, VulnCheck added that later activity involved a wget.sh script and persistent webshells. These were built by chaining an HTTP-in node to a function node and an exec node, at paths such as /cmd. VulnCheck said it “did not retrieve or analyze the bot binary itself”, so it makes no claims about what the malware can do.

The source address sits in Microsoft’s AS8075 network and geolocates to Brazil. It produced 16 events against this flaw between 30 October and 1 November. Over the same period it made 125 hits against eight vulnerabilities, using at least five user agents. Those included Apache Solr CVE-2019-17558 and flaws in Camunda, Gitea, MLflow, Traefik and Joomla. VulnCheck called it “opportunistic mass scanning rather than a targeted attack”. No group has been named.

Who runs these systems

CISA lists the affected sectors as chemical, critical manufacturing, energy and transportation, with the product deployed worldwide.

VulnCheck noted that the tool is used across manufacturing, utilities, healthcare and agriculture. Emerson’s documentation also mentions it, though VulnCheck has not validated any impact there. VulnCheck published a detection on 27 October and added the flaw to its own exploited-vulnerabilities list. It was not in CISA’s KEV catalogue at the time of writing.

TSN has covered similar embedded and edge-device fixes, including three TLS flaws patched in the GoAhead web server and Cisco’s exploited ASA and FTD VPN zero-day. The pattern of a flaw being exploited before it reaches CISA’s list echoes the ESXi logging bug used by Warp Panda. Shipping and port operators can track related weaknesses in the maritime industry’s free vulnerability database.

A missing login, not a clever exploit, is the real exposure

There is no memory-corruption trick here. CVE-2026-58115 works because the editor does exactly what it was built to do. It lets whoever reaches it deploy a flow, and some flows run system commands. Siemens rates that a 10 because, on the IoT2050, there was no password in the way.

So the Siemens firmware update matters, but the wider lesson reaches past one product. VulnCheck framed the risk as Node-RED without adminAuth, which describes any installation where the login was never switched on. Anyone running the tool on other hardware should apply the same check.

Timing is the second point. Siemens published its fix on 11 August, and the first exploitation VulnCheck saw came on 30 October. That left a window of more than ten weeks to patch, and operators who missed it are now within reach of commodity scanners.

The scanner’s breadth matters too. It was trying eight flaws across unrelated products, which suggests this flaw has simply been added to a standard menu. Reachable instances will be tried whether or not anyone is singling them out.

The absence from CISA’s KEV catalogue means no US federal patch deadline has been triggered. That is a reason to act on the vendor advice now, not to wait.

The quickest test is the one VulnCheck suggests: try to open your editor from outside the network. If it loads without asking for a password, it will load for the scanner too.

Sources

• VulnCheck: Exploitation targeting Node-RED (2 November 2026)
• CISA ICS advisory ICSA-26-237-03: Siemens SIMATIC IoT2050 Advanced (25 August 2026)
• Siemens ProductCERT SSA-834709
• Node-RED user guide: Securing Node-RED

Related stories

• Cisco Patches ASA and FTD VPN Zero-Day That Attackers Are Using
• GoAhead 6.1.1 Fixes Three TLS Flaws in Embedded Device Web Server
• Maritime Groups Launch a Free Database of Ship Cyber Vulnerabilities