EN PT-BR
← Voltar ao feed
critical industrial manufacturing

Attackers Exploit Critical Siemens SIMATIC IoT2050 Node-RED Flaw (CVE-2026-58115) to Deploy Linux Bot and Command Backdoors

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 02:34 · coletado há 1 hora

VulnCheck reports active exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. An unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges. Siemens published its advisory in August 2026. VulnCheck first saw exploitation attempts against its honeypots as of October 30, 2026, aimed at downloading and running a Linux bot. Later requests planted persistent command backdoors that survive a reboot.

Entenda a falha

A vulnerabilidade

CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw for a critical function in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. An unauthenticated remote attacker who can reach the interface can create malicious flows and run arbitrary code on the device with maximum privileges. Siemens says the fix is in version 4.3.4.1 or later, so earlier versions are implied to be affected. The flaw is being exploited in the wild.

Como funciona

Node-RED lets users define flows, which are chains of nodes that receive events, process them and can run system commands. On the affected devices, the HTTP interface that accepts flow definitions does not ask the caller to authenticate. A remote request can therefore deploy a new flow and trigger it. The flow then runs with the privileges of the underlying service, which are maximal, and the observed flows ran shell commands. Some flows fetched a binary and others exposed an HTTP-in endpoint wired to an exec node, which takes commands later.

Por que é vulnerável

The root cause is a missing authentication check on a critical function: the Node-RED editor, admin API and HTTP nodes are reachable without credentials in the affected setup. Because Node-RED is designed to execute code defined in flows, leaving it unauthenticated amounts to remote code execution. The articles do not say why it went unnoticed. Siemens' mitigations point to the same cause: enable credential or OAuth/OpenID authentication for the editor and admin API, and basic authentication for HTTP nodes and the Dashboard. The fix is in 4.3.4.1.

Como foi descoberta

Siemens published its advisory in August 2026; the articles do not say who reported the flaw or how it was found. VulnCheck then reported exploitation against its honeypot network as of October 30, 2026, which is how the in-the-wild abuse came to light. Researcher Patrick Garrity described the first request as a complete exploit, hidden behind three layers of encoding. Later requests switched to a two-stage download and to command backdoors.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 04:16.

Detalhes técnicos

  • The first exploit request deployed a Node-RED flow, triggered it automatically and pulled a binary from an attacker-controlled server, all behind three layers of encoding (Patrick Garrity, VulnCheck).
  • The flow runs a shell script wrapper that uses wget (with curl as fallback) to fetch an AMD64 botnet binary from 85.215.73[.]250. The binary is saved as /dev/shm/.b and executed.
  • The attackers then moved to a two-stage process in which wget retrieves a second script, wget.sh, from the same server.
  • Another request used wget/curl against 45.194.90[.]57:38472 to fetch a payload named .sys_update. It is saved as /tmp/.kworker, disguised as a kernel worker thread, and executed.
  • The functionality of wget.sh and .kworker is unknown because they could not be retrieved.
  • Several requests deployed no downloader. Instead the flow exposes an HTTP-in endpoint (for example /cmd or a randomly named path) wired through a function node to an exec node with addpay enabled. The attacker can run arbitrary commands later via a query parameter, and this backdoor persists even if a memory-backed implant is lost on reboot.

Remediação

  • Update to version 4.3.4.1 or later.
  • Alternatively, uninstall Node-RED or harden it: secure the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and secure the HTTP nodes and Node-RED Dashboard with basic authentication.
  • Hunt for unexpected Node-RED flows, HTTP-in endpoints such as /cmd, and the files /dev/shm/.b and /tmp/.kworker. Check for connections to the listed IPs.

Linha do tempo

  1. thehackernews.com ↗ · pub. 03/11/2026 02:34 · coletado 03/11 04:00 primeiro registro

    Attackers Exploit Critical Siemens SIMATIC IoT2050 Node-RED Flaw (CVE-2026-58115) to Deploy Linux Bot and Command Backdoors

    ler a análise desta fonte

    VulnCheck reports active exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. An unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges. Siemens published its advisory in August 2026. VulnCheck first saw exploitation attempts against its honeypots as of October 30, 2026, aimed at downloading and running a Linux bot. Later requests planted persistent command backdoors that survive a reboot.

    Technical Details

    • The first exploit request deployed a Node-RED flow, triggered it automatically and pulled a binary from an attacker-controlled server, all behind three layers of encoding (Patrick Garrity, VulnCheck).
    • The flow runs a shell script wrapper that uses wget (with curl as fallback) to fetch an AMD64 botnet binary from 85.215.73[.]250. The binary is saved as /dev/shm/.b and executed.
    • The attackers then moved to a two-stage process in which wget retrieves a second script, wget.sh, from the same server.
    • Another request used wget/curl against 45.194.90[.]57:38472 to fetch a payload named .sys_update. It is saved as /tmp/.kworker, disguised as a kernel worker thread, and executed.
    • The functionality of wget.sh and .kworker is unknown because they could not be retrieved.
    • Several requests deployed no downloader. Instead the flow exposes an HTTP-in endpoint (for example /cmd or a randomly named path) wired through a function node to an exec node with addpay enabled. The attacker can run arbitrary commands later via a query parameter, and this backdoor persists even if a memory-backed implant is lost on reboot.

    Remediation

    • Update to version 4.3.4.1 or later.
    • Alternatively, uninstall Node-RED or harden it: secure the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and secure the HTTP nodes and Node-RED Dashboard with basic authentication.
    • Hunt for unexpected Node-RED flows, HTTP-in endpoints such as /cmd, and the files /dev/shm/.b and /tmp/.kworker. Check for connections to the listed IPs.