Weekly CVE roundup: exploited Siemens SIMATIC IoT2050, CryptoPayment Gateway and Sogou Input flaws absent from CISA KEV
A weekly vulnerability roundup covering November 2-8, 2026 records 3,570 new CVEs, of which 311 are rated critical (310 at CVSS 9.0 or above) and 1,220 high. Seven flaws were flagged as exploited by the publisher's own intelligence feed, and none of them appeared in the CISA KEV catalog as of version 2026.11.06, leaving no lead time to measure against KEV this week. Four of the seven flags are backed by public attack reports: Siemens SIMATIC IoT2050, the CryptoPayment Gateway WordPress plugin, Zyxel GS1900 switches and Sogou Input Method; for the Linux kernel, Puppet and OpenSSH items the report states vendors and researchers see no exploitation so far. The most urgent entries are two CVSS 10.0 issues, one of which has no patch at all.
Entenda a falha
A vulnerabilidade
Three flaws are covered. CVE-2026-58115 (CVSS 10.0) is in Siemens SIMATIC IoT2050 industrial gateways: the Node-RED interface requires no login, so a remote attacker with network reach can run their own flows on the device. It is fixed in 4.3.4.1. CVE-2026-81648 (CVSS 10.0) is in the CryptoPayment Gateway WordPress plugin: unauthenticated users can delete files and read stored wallet credentials. No fix exists and the plugin was closed in the WordPress directory on 28 August. CVE-2026-120422 (CVSS 8.9) is in Sogou Input Method: SGTool.exe fetched its configuration over plain HTTP, so an attacker who can hijack that traffic can deliver malware. It is fixed in 16.10.
Como funciona
On the SIMATIC IoT2050, the Node-RED interface accepts connections without asking for credentials, so anyone who can reach it can deploy flows. Attackers used this to push malicious flows that fetched a Linux bot, and some implants survived reboots. In the Sogou case, SGTool.exe requests its configuration from a server over unencrypted HTTP. An attacker positioned to intercept or redirect that traffic can answer with content of their choosing, which ended up delivering the DarkVigil implant. For the CryptoPayment plugin, the articles only say that unauthenticated requests can delete files and read wallet credentials, without describing the internal steps.
Por que é vulnerável
For the IoT2050 the root cause is missing authentication on the Node-RED interface. For Sogou it is the insecure choice of fetching configuration over plaintext HTTP, which lets a network attacker tamper with it. For the CryptoPayment plugin the articles describe missing authorization on file deletion and credential disclosure, but give no deeper root cause. They do not say why any of these went unnoticed. The IoT2050 fix is in version 4.3.4.1 and the Sogou fix is in 16.10, and the articles do not describe what the fixes change. Siemens also offers removing Node-RED as an alternative.
Onde está
The articles name the Node-RED interface on the SIMATIC IoT2050 and the SGTool.exe component of Sogou Input Method; no file, function or commit is named for the CryptoPayment plugin.
Como foi descoberta
All three were found through exploitation seen in the wild. VulnCheck researcher Patrick Garrity saw attackers hitting its honeypots by 30 October 2026 against the IoT2050 Node-RED interface. Defused Cyber reported in-the-wild exploitation attempts against the CryptoPayment plugin, which had been closed in the WordPress directory on 28 August. ESET attributes abuse of the Sogou flaw since 1 July 2026 to the China-aligned group SlippyNunchucks, with victims in Hong Kong, Thailand, Japan and other countries. The roundup notes none of these were in CISA KEV as of version 2026.11.06.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article mentions a published proof of concept. Working exploitation exists in real attacks: malicious Node-RED flows against the IoT2050, exploitation attempts against the CryptoPayment plugin, and traffic hijacking that delivered the DarkVigil implant via Sogou. Because these are active attacks, patching or removal is urgent, especially for CryptoPayment, which has no fix.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 23:16.
Detalhes técnicos
- Siemens SIMATIC IoT2050 (CVE-2026-58115, CVSS 10.0): the Node-RED interface on these industrial gateways required no authentication. VulnCheck researcher Patrick Garrity observed attackers hitting honeypots by 30 October 2026, deploying malicious flows that pulled a Linux bot, with some implants persisting across reboots.
- CryptoPayment Gateway (CVE-2026-81648, CVSS 10.0): the WordPress plugin allows unauthenticated file deletion and disclosure of stored wallet credentials. Defused Cyber reported in-the-wild exploitation attempts; the plugin was closed in the WordPress directory on 28 August and no fix exists.
- Sogou Input Method (CVE-2026-120422, CVSS 8.9): SGTool.exe retrieved its configuration over plaintext HTTP. ESET attributes abuse since 1 July 2026 to the China-aligned group SlippyNunchucks, which hijacked that traffic to deliver the DarkVigil implant to victims in Hong Kong, Thailand, Japan and other countries.
Remediação
- Update SIMATIC IoT2050 to 4.3.4.1 or remove Node-RED.
- Remove the CryptoPayment Gateway plugin, as no patch is available.
- Install the October Zyxel GS1900 firmware and keep switch administration pages off untrusted networks.
- Update Sogou Input Method to 16.10 or later.
- Patch WordPress to 7.1.4 and SonicOS per SonicWall's advisory, then schedule the Linux kernel, Puppet and OpenSSH fixes.
No verification against vendor advisories, NVD or the CISA KEV catalog could be completed for this record; the figures, CVSS scores and exploitation claims come from the publication's own feed.
Linha do tempo
-
Weekly CVE roundup: exploited Siemens SIMATIC IoT2050, CryptoPayment Gateway and Sogou Input flaws absent from CISA KEV
ler a análise desta fonte ocultar
A weekly vulnerability roundup covering November 2-8, 2026 records 3,570 new CVEs, of which 311 are rated critical (310 at CVSS 9.0 or above) and 1,220 high. Seven flaws were flagged as exploited by the publisher's own intelligence feed, and none of them appeared in the CISA KEV catalog as of version 2026.11.06, leaving no lead time to measure against KEV this week. Four of the seven flags are backed by public attack reports: Siemens SIMATIC IoT2050, the CryptoPayment Gateway WordPress plugin, Zyxel GS1900 switches and Sogou Input Method; for the Linux kernel, Puppet and OpenSSH items the report states vendors and researchers see no exploitation so far. The most urgent entries are two CVSS 10.0 issues, one of which has no patch at all.
Technical Details
- Siemens SIMATIC IoT2050 (CVE-2026-58115, CVSS 10.0): the Node-RED interface on these industrial gateways required no authentication. VulnCheck researcher Patrick Garrity observed attackers hitting honeypots by 30 October 2026, deploying malicious flows that pulled a Linux bot, with some implants persisting across reboots.
- CryptoPayment Gateway (CVE-2026-81648, CVSS 10.0): the WordPress plugin allows unauthenticated file deletion and disclosure of stored wallet credentials. Defused Cyber reported in-the-wild exploitation attempts; the plugin was closed in the WordPress directory on 28 August and no fix exists.
- Sogou Input Method (CVE-2026-120422, CVSS 8.9): SGTool.exe retrieved its configuration over plaintext HTTP. ESET attributes abuse since 1 July 2026 to the China-aligned group SlippyNunchucks, which hijacked that traffic to deliver the DarkVigil implant to victims in Hong Kong, Thailand, Japan and other countries.
Remediation
- Update SIMATIC IoT2050 to 4.3.4.1 or remove Node-RED.
- Remove the CryptoPayment Gateway plugin, as no patch is available.
- Install the October Zyxel GS1900 firmware and keep switch administration pages off untrusted networks.
- Update Sogou Input Method to 16.10 or later.
- Patch WordPress to 7.1.4 and SonicOS per SonicWall's advisory, then schedule the Linux kernel, Puppet and OpenSSH fixes.
No verification against vendor advisories, NVD or the CISA KEV catalog could be completed for this record; the figures, CVSS scores and exploitation claims come from the publication's own feed.