ThreatRoundup
CriticalCVE-2026-58115IOCsRemote AttackerSecurityWeek

Node-RED’s Perfect-10 Bug Is Now Being Used to Plant Linux Bots

VulnCheck says attackers have exploited CVE-2026-58115, a CVSS 10 missing-authentication bug in Node-RED found in Siemens IoT2050 gateways, since Oct. 30 to drop Linux bots and webshells.

ThreatRoundup · · 2 min read

Attackers are using a perfect-10 Node-RED bug to take over exposed automation boxes with a single web request. VulnCheck says its canaries caught the first full exploit for CVE-2026-58115 on Oct. 30, followed by 15 more attempts from the same address through Nov. 1. Siemens disclosed the flaw in August after finding it in SIMATIC IoT2050 Advanced industrial gateways running Node-RED, and both SecurityWeek and The Hacker News reported the attacks on Nov. 3.

For defenders

The bug: CVE-2026-58115, CVSS 10.0, missing authentication on Node-RED’s HTTP admin interface. An unauthenticated attacker can deploy their own flow and, per Siemens advisory SSA-834709, run code on the device “with maximum privileges.” All IoT2050 Advanced versions before V4.3.4.1 are affected; 4.3.4.1 or later fixes it. A public exploit is reported in one GitHub repository. VulnCheck notes Emerson also ships Node-RED but hasn’t checked whether its products are affected, and neither source says whether stock Node-RED installs without adminAuth are hit the same way. Treat any internet-facing Node-RED with an open editor as exposed.

Exploitation: confirmed by VulnCheck (it’s in VulnCheck’s own KEV list; not in CISA’s KEV at publication). One POST /flows request plants an inject node wired to an exec node, which decodes a base64 blob and pipes it to sh (T1190 (Exploit Public-Facing Application), T1059.004 (Command and Scripting Interpreter: Unix Shell)). The dropper fetches a Linux bot into /dev/shm/.b; a later variant pulls /tmp/.kworker, named to pass for a kernel thread (T1105 (Ingress Tool Transfer), T1036.005 (Masquerading: Match Legitimate Resource Name or Location)). Some attackers skip the bot and leave an HTTP endpoint such as /cmd wired to an exec node, a webshell that survives a reboot (T1505.003 (Server Software Component: Web Shell)). The scanning IP sits in Microsoft’s cloud and also hit seven other CVEs, so VulnCheck treats it as rented or compromised.

Network
4.201.105[.]116 (scanner, AS8075)
hxxp://85.215.73[.]250:8080/bot-linux-amd64
hxxp://85.215.73[.]250:8080/wget.sh
hxxp://45.194.90[.]57:38472/.sys_update

Host
/dev/shm/.b
/tmp/.s
/tmp/.kworker
Flows with an “http in” node wired to an “exec” node

What it means for you

Node-RED is a drag-and-drop tool for wiring sensors, machines and web services together, and it’s popular with factories, building managers and home-automation fans alike. If one of these is reachable from the internet without a login, a stranger can make it run any command they like. If you don’t use Node-RED, or yours sits behind a VPN with a password on the editor, there’s nothing to do.

Do this now

  1. Find every Node-RED instance you run, including ones built into industrial gateways, and take any that face the internet offline or behind a VPN.
  2. Siemens IoT2050 owners: update to 4.3.4.1 or later, or uninstall Node-RED if you don’t need it.
  3. Turn on adminAuth for the editor and admin API, and put basic authentication on HTTP nodes and the dashboard, as in the Node-RED security guide.
  4. Open your flows and delete anything you didn’t build, especially exec nodes and unexpected HTTP endpoints. Then look for hidden files in /dev/shm and /tmp.

CVE at a glance

CVE-2026-58115CriticalPublic exploitSiemens SIMATIC IoT2050 Advanced
CVSS
10 Critical (v4.0)
EPSS
0.9% chance of exploitation in the next 30 days (higher than 59.4% of CVEs)
Exploited in the wild
Not on CISA’s KEV list
Public exploit
Yes, reported in 1 GitHub repository

Full CVE details

Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.

More from the Roundup