---
id: "CMP-202611-skgc6d"
kind: "campaign"
aliases: []
title: "Attackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)"
severity: "critical"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Node-RED", "fixed": [], "ecosystem": "npm"}, {"name": "Siemens SIMATIC IoT2050 Advanced", "fixed": ["V4.3.4.1"], "affected": "< V4.3.4.1 with Node-RED installed", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T11:56:43+00:00"
updated_at: "2026-11-03T11:56:43+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T11:56:43+00:00"}]
---

# Attackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)

Since 30 Oct 2026, automated mass exploitation hits Node-RED instances whose editor/admin API has no authentication (CVE-2026-58115, CVSS 10, assigned by Siemens for SIMATIC IoT2050 Advanced with Industrial OS before V4.3.4.1). One POST /flows deploys an inject+exec flow that downloads and runs a Linux bot from /dev/shm, or plants an HTTP-in endpoint that runs any command. VulnCheck recorded 16 exploit events from one source IP between 30 Oct and 1 Nov, and the same IP also probes Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla. Confirmed exposed: VulnCheck canaries. Real victims: unknown. Bot capabilities: unknown, the binary was not analyzed. Any internet-reachable Node-RED without adminAuth is a target, including Node-RED embedded in OT products (Emerson uses Node-RED, impact not validated).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:Node-RED affected ? fixed ?
- vendor:Siemens SIMATIC IoT2050 Advanced affected < V4.3.4.1 with Node-RED installed fixed V4.3.4.1

## How to check

Check whether any Node-RED editor (default port 1880) is reachable from the internet, and whether settings.js has adminAuth unset: an unauthenticated GET /flows returning 200 means exposed. In deployed flows, look for unexpected exec nodes (e.g. 'echo <base64> | base64 -d | sh'), inject nodes set to fire once, and http in endpoints like /cmd or random paths wired to exec. On the host, look for files /dev/shm/.b, /tmp/.s, /tmp/.kworker, and for traffic to 85.215.73.250:8080 (bot-linux-amd64, wget.sh), 45.194.90.57:38472 (/.sys_update) or from 4.201.105.116. On SIMATIC IoT2050 Advanced, check for firmware older than V4.3.4.1 with Node-RED installed.

## Fix

Take Node-RED off the internet now, or put it behind a VPN or an authenticating proxy. Enable adminAuth (credentials or OAuth/OpenID) for the editor and admin API, put basic auth on HTTP nodes and the Dashboard, and use HTTPS. Update SIMATIC IoT2050 Advanced to V4.3.4.1 or later, or uninstall Node-RED (Siemens SSA-834709). If an instance was exposed, review and remove unknown flows, kill and delete the dropped files, block the listed IPs, and treat the host as compromised.

## Timeline

- 2026-11-03T11:56:43+00:00 analyst

## Documents

- [describes] Max-severity bug in widely used OT programming tool exploited to deliver malware https://news.ycombinator.com/item?id=50350798
- [describes] Exploitation Targeting Node-RED, a Tool Embedded in ICS Products (VulnCheck) https://www.vulncheck.com/blog/exploitation-targeting-node-red

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_