{"id":"CMP-202611-skgc6d","kind":"campaign","aliases":[],"related":[],"title":"Attackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)","description":null,"summary":"Since 30 Oct 2026, automated mass exploitation hits Node-RED instances whose editor/admin API has no authentication (CVE-2026-58115, CVSS 10, assigned by Siemens for SIMATIC IoT2050 Advanced with Industrial OS before V4.3.4.1). One POST /flows deploys an inject+exec flow that downloads and runs a Linux bot from /dev/shm, or plants an HTTP-in endpoint that runs any command. VulnCheck recorded 16 exploit events from one source IP between 30 Oct and 1 Nov, and the same IP also probes Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla. Confirmed exposed: VulnCheck canaries. Real victims: unknown. Bot capabilities: unknown, the binary was not analyzed. Any internet-reachable Node-RED without adminAuth is a target, including Node-RED embedded in OT products (Emerson uses Node-RED, impact not validated).","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-03T11:56:43+00:00","products":[{"name":"Node-RED","fixed":[],"ecosystem":"npm"},{"name":"Siemens SIMATIC IoT2050 Advanced","fixed":["V4.3.4.1"],"affected":"< V4.3.4.1 with Node-RED installed","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Check whether any Node-RED editor (default port 1880) is reachable from the internet, and whether settings.js has adminAuth unset: an unauthenticated GET /flows returning 200 means exposed. In deployed flows, look for unexpected exec nodes (e.g. 'echo <base64> | base64 -d | sh'), inject nodes set to fire once, and http in endpoints like /cmd or random paths wired to exec. On the host, look for files /dev/shm/.b, /tmp/.s, /tmp/.kworker, and for traffic to 85.215.73.250:8080 (bot-linux-amd64, wget.sh), 45.194.90.57:38472 (/.sys_update) or from 4.201.105.116. On SIMATIC IoT2050 Advanced, check for firmware older than V4.3.4.1 with Node-RED installed.","fix":"Take Node-RED off the internet now, or put it behind a VPN or an authenticating proxy. Enable adminAuth (credentials or OAuth/OpenID) for the editor and admin API, put basic auth on HTTP nodes and the Dashboard, and use HTTPS. Update SIMATIC IoT2050 Advanced to V4.3.4.1 or later, or uninstall Node-RED (Siemens SSA-834709). If an instance was exposed, review and remove unknown flows, kill and delete the dropped files, block the listed IPs, and treat the host as compromised.","status":"open","published_at":null,"first_seen_at":"2026-11-03T11:56:43+00:00","triaged_at":"2026-11-03T11:56:43+00:00","updated_at":"2026-11-03T11:56:43+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2026':9A,56B '-202611':24A '-58115':10A,57B '/dev/shm':88B '/flows':74B '1':113B '10':59B '16':102B '2026':40B '30':38B,110B 'adminauth':152B 'advanc':66B 'advanced':32A 'also':119B 'analyz':143B 'apach':121B 'api':51B 'assign':60B 'attack':1A 'authent':54B 'autom':41B 'binari':140B 'bot':18A,86B,136B 'campaign':33B 'camunda':123B 'canari':132B 'capabl':137B 'cmp':23A 'command':20A,99B 'confirm':129B 'cve':8A,55B 'cvss':58B 'deploy':15A,75B 'download':81B 'earli':35B 'early-warn':34B 'editor':7A 'editor/admin':50B 'embed':160B 'emerson':164B 'endpoint':95B 'event':104B 'exec':78B 'exploit':2A,43B,103B 'expos':130B 'flow':79B 'gitea':124B 'hit':44B 'http':93B 'http-in':92B 'impact':169B 'includ':156B 'industri':68B 'inject':77B 'instanc':48B 'internet':146B 'internet-reach':145B 'iot2050':13A,31A,65B 'ip':108B,118B 'joomla':128B 'linux':17A,85B 'mass':42B 'mlflow':125B 'node':5A,27A,46B,149B,158B,167B 'node-r':4A,45B,148B,157B,166B 'node-red':26A 'nov':114B 'oct':39B,111B 'one':72B,106B 'os':69B 'ot':162B 'plant':90B 'post':73B 'probe':120B 'product':163B 'reachabl':147B 'real':133B 'record':101B 'red':6A,28A,47B,150B,159B,168B 'run':83B,97B 'siemen':11A,62B 'siemens':29A 'simat':12A,64B 'simatic':30A 'sinc':37B 'skgc6d':25A 'solr':122B 'sourc':107B 'target':155B 'traefik':126B 'unauthent':3A 'unknown':135B,138B 'use':165B 'v4.3.4.1':71B 'valid':171B 'victim':134B 'vulncheck':22A,100B,131B 'warn':36B 'webshel':21A 'whose':49B 'without':151B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["nodered","siemenssimaticiot2050advanced","simaticiot2050advanced"],"ptokens":["advanced","iot2050","node","red","siemens","simatic"],"labels":["campaign","critical","earlywarning","infrastructure"],"first_public_at":"2026-11-02T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-skgc6d","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T11:56:43+00:00","fetched_at":"2026-11-03T11:56:43+00:00","note":null}],"documents":[{"id":57357,"url":"https://news.ycombinator.com/item?id=50350798","title":"Max-severity bug in widely used OT programming tool exploited to deliver malware","kind":"post","source":"hackernews","publisher":null,"text":"Max-severity bug in widely used OT programming tool exploited to deliver malware\nhttps://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-03T11:46:53+00:00","relation":"describes","confidence":null,"note":null},{"id":57359,"url":"https://www.vulncheck.com/blog/exploitation-targeting-node-red","title":"Exploitation Targeting Node-RED, a Tool Embedded in ICS Products (VulnCheck)","kind":"blog","source":"analyst","publisher":null,"text":"VulnCheck canaries caught in-the-wild exploitation of CVE-2026-58115 (unauthenticated Node-RED admin API, Siemens SIMATIC IoT2050 Advanced) from 2026-10-30: single POST /flows deploying inject+exec flow, base64 dropper downloading http://85.215.73[.]250:8080/bot-linux-amd64 to /dev/shm/.b; variant wget.sh to /tmp/.s; second server http://45.194.90[.]57:38472/.sys_update saved as /tmp/.kworker; some flows plant http-in webshell endpoints (e.g. /cmd). Source IP 4.201.105.116 (AS8075), 16 events Oct 30-Nov 1, also hitting Solr, Camunda, Gitea, MLflow, Traefik, Joomla. Binary not analyzed.","published_at":"2026-11-02T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}