Node-RED CVE-2026-58115 (CVSS 10) exploited in Siemens SIMATIC IoT2050 to drop Linux bot and persistent backdoors

Linha do tempo

1. cert.cyber.gouv.fr ↗ · pub. 04/11/2026 21:00 · coletado 06/11 12:00

   CERT-FR: Siemens Desigo CC (Brotli CVE-2026-111497) and SIMATIC IoT2050 Node-RED (CVE-2026-58115) vulnerabilities

   ler a análise desta fonte ocultar

   CERT-FR bulletin CERTFR-2026-AVI-1464 (5 November 2026) covers vulnerabilities in Siemens products, based on advisories SSA-045512 and SSA-834709 of 4 November 2026. CERT-FR says they allow remote code execution, denial of service, loss of data confidentiality and integrity, and security policy bypass. The bulletin names two CVEs, CVE-2026-111497 and CVE-2026-58115, and lists Desigo CC V8 and V9 (without the latest .NET patch) and SIMATIC IoT2050 before 4.3.4-1 as affected. According to the Siemens advisories (cert-portal.siemens.com), the first is a Brotli decoder flaw that reaches Desigo CC through .NET, and the second is missing authentication in Node-RED on SIMATIC IoT2050. The CERT-FR bulletin does not mention active exploitation.

   Technical Details

   • CVE-2026-111497 (SSA-045512): a buffer overflow (CWE-787) in the Brotli decoder (c/dec/decode.c). A remote, unauthenticated attacker can trigger it with a crafted Brotli stream. It can cause memory corruption, data leakage, denial of service or potentially code execution. CVSS v3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N) and CVSS v4.0 is 9.2. The affected Brotli versions are 1.0.3 through 1.2.0. Desigo CC V8 and V9 are affected through .NET (cert-portal.siemens.com).
   • CVE-2026-58115 (SSA-834709): the Node-RED HTTP interface on SIMATIC IoT2050 Advanced, Basic, M.2 and SM does not enforce authentication (CWE-306). It applies to Industrial OS images before V4.3.4-1 with Node-RED installed. A remote attacker can create malicious flows and run commands with maximum privileges. CVSS v3.1 is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) and CVSS v4.0 is 10.0 (cert-portal.siemens.com).

   Remediation

   • Desigo CC V8 and V9: install the latest .NET security updates through Windows Update (cert-portal.siemens.com).
   • Other products that bundle Brotli: update to 1.0.10, 1.1.1 or 1.2.1 (cert-portal.siemens.com).
   • SIMATIC IoT2050: update to V4.3.4-1 or later. As a mitigation, uninstall Node-RED or harden it as described in the Node-RED guide, and restrict network access to the devices (cert-portal.siemens.com).
2. helpnetsecurity.com ↗ · pub. 03/11/2026 09:59 · coletado 03/11 12:02

   Node-RED Flaw CVE-2026-58115 Actively Exploited to Drop Linux Bot and Backdoors

   This article adds that the attacking IP geolocates to Brazil (despite being within Microsoft's network) and hit the Node-RED flaw 16 times between October 30 and November 1, while also logging 125 hits against 8 different CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, indicating opportunistic mass scanning rather than a targeted attack. It also names the dropped binary as **bot-linux-amd64** and notes VulnCheck added CVE-2026-58115 to its own KEV catalog while CISA had not done so yet.

   ler a análise desta fonte ocultar

   This article adds that the attacking IP geolocates to Brazil (despite being within Microsoft's network) and hit the Node-RED flaw 16 times between October 30 and November 1, while also logging 125 hits against 8 different CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, indicating opportunistic mass scanning rather than a targeted attack. It also names the dropped binary as bot-linux-amd64 and notes VulnCheck added CVE-2026-58115 to its own KEV catalog while CISA had not done so yet.

   VulnCheck researcher Patrick Garrity detailed active exploitation of CVE-2026-58115, a missing-authentication flaw in Node-RED that also affects Siemens ICS/OT products such as the SIMATIC IoT2050 Advanced. On October 30, 2026, a VulnCheck canary captured a complete exploit chain that deployed a malicious Node-RED flow, auto-triggered it, and pulled a binary named bot-linux-amd64 from an attacker-controlled server, all obfuscated behind three layers of encoding. The attacking IP, part of Microsoft's AS8075 and geolocating to Brazil, hit the Node-RED flaw 16 times between October 30 and November 1, and across VulnCheck's wider canary data logged 125 hits against 8 different CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, consistent with opportunistic mass scanning rather than a targeted campaign.

   Technical Details

   • The exploit wires a built-in inject node to an exec node so the flow runs a shell command automatically once deployed, with no further interaction needed.
   • The dropped binary (bot-linux-amd64) is stored under a hidden name in a memory-backed location (/dev/shm) and run in the background; VulnCheck could not retrieve the binary, so its exact function (cryptominer, DDoS bot, reverse shell, etc.) is unknown.
   • Later requests delivered additional payloads: a shell script from the same download server, and a separate file disguised as a kernel worker thread fetched from a second server.
   • Several requests installed persistent webshells allowing attackers to return and run commands at will; unlike the memory-resident bot, these survive a reboot.
   • VulnCheck added CVE-2026-58115 to its own KEV catalog after observing in-the-wild exploitation; as of publication, CISA had not added it to its KEV catalog.

   Remediation

   • Check today whether Node-RED instances, including those inside OT environments, are reachable from outside the network.
   • Apply available updates and implement detections to reduce exploitation risk.
   • IOCs including the attacker source IP and both payload server IPs are published by VulnCheck.
3. securityweek.com ↗ · pub. 03/11/2026 09:10 · coletado 03/11 10:00

   Critical Node-RED Flaw (CVE-2026-58115) in Siemens SIMATIC IoT2050 Actively Exploited

   This article adds attribution detail showing the initial exploitation attempt on October 30, 2026 originated from an IP address within AS8075, Microsoft's network, and reports that by November 1, VulnCheck had observed 15 additional attacks from the same IP address delivering further payloads, including persistent webshells.

   ler a análise desta fonte ocultar

   This article adds attribution detail showing the initial exploitation attempt on October 30, 2026 originated from an IP address within AS8075, Microsoft's network, and reports that by November 1, VulnCheck had observed 15 additional attacks from the same IP address delivering further payloads, including persistent webshells.

   VulnCheck reports active in-the-wild exploitation of CVE-2026-58115 (CVSS 10/10), a missing-authentication vulnerability in the Node-RED HTTP interface used in Siemens SIMATIC IoT2050 Advanced devices. The flaw allows unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges on affected systems. VulnCheck first observed successful exploitation on October 30, 2026, from an IP address within AS8075, Microsoft's network, which deployed a Node-RED flow, triggered it automatically, and pulled a Linux bot binary from an attacker-controlled server behind three layers of encoding. By November 1, the same IP had conducted 15 additional attacks delivering further payloads, including persistent webshells enabling arbitrary command execution.

   Technical Details

   • The initial payload was a Linux bot; based on the filename, VulnCheck believes attackers built payloads for multiple architectures.
   • The execution command used did not verify whether installation succeeded.
   • Threat actors are actively scanning for internet-exposed Node-RED instances lacking adminAuth and exploiting them automatically via a single HTTP request.

   Remediation

   • Siemens has patched the issue in SIMATIC IoT2050 Advanced version 4.3.4.1 and later.
   • Organizations running Node-RED, including in ICS/OT environments, should verify whether it is reachable from outside the network and review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers leave webshells rather than bots.
4. thehackernews.com ↗ · pub. 03/11/2026 02:34 · coletado 03/11 04:00

   Attackers Exploit Critical Siemens SIMATIC IoT2050 Node-RED Flaw (CVE-2026-58115) to Deploy Linux Bot and Command Backdoors

   ler a análise desta fonte ocultar

   VulnCheck reports active exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. An unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges. Siemens published its advisory in August 2026. VulnCheck first saw exploitation attempts against its honeypots as of October 30, 2026, aimed at downloading and running a Linux bot. Later requests planted persistent command backdoors that survive a reboot.

   Technical Details

   • The first exploit request deployed a Node-RED flow, triggered it automatically and pulled a binary from an attacker-controlled server, all behind three layers of encoding (Patrick Garrity, VulnCheck).
   • The flow runs a shell script wrapper that uses wget (with curl as fallback) to fetch an AMD64 botnet binary from 85.215.73[.]250. The binary is saved as /dev/shm/.b and executed.
   • The attackers then moved to a two-stage process in which wget retrieves a second script, wget.sh, from the same server.
   • Another request used wget/curl against 45.194.90[.]57:38472 to fetch a payload named .sys_update. It is saved as /tmp/.kworker, disguised as a kernel worker thread, and executed.
   • The functionality of wget.sh and .kworker is unknown because they could not be retrieved.
   • Several requests deployed no downloader. Instead the flow exposes an HTTP-in endpoint (for example /cmd or a randomly named path) wired through a function node to an exec node with addpay enabled. The attacker can run arbitrary commands later via a query parameter, and this backdoor persists even if a memory-backed implant is lost on reboot.

   Remediation

   • Update to version 4.3.4.1 or later.
   • Alternatively, uninstall Node-RED or harden it: secure the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and secure the HTTP nodes and Node-RED Dashboard with basic authentication.
   • Hunt for unexpected Node-RED flows, HTTP-in endpoints such as /cmd, and the files /dev/shm/.b and /tmp/.kworker. Check for connections to the listed IPs.
5. theregister.com ↗ · pub. 02/11/2026 19:55 · coletado 02/11 21:00 primeiro registro

   Unknown actor exploits max-severity Node-RED flaw CVE-2026-58115 to deploy Linux bot via malicious flows

   ler a análise desta fonte ocultar

   VulnCheck reports that an unknown actor is exploiting CVE-2026-58115, a CVSS 10.0 flaw in Node-RED, to deploy a flow that downloads and runs a Linux bot. Node-RED is widely used for workflow automation in ICS/OT environments and is embedded in commercial products such as the Siemens SIMATIC IoT2050. A VulnCheck canary caught an attacker exploiting the flaw on October 30, 2026. The activity came from a single IP that also probed other products, which suggests opportunistic mass scanning rather than targeted attacks. The flaw is in VulnCheck's KEV catalog but, as of publication, not in CISA's KEV.

   Technical Details

   • Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface. Unauthenticated remote attackers can create malicious flows that execute system commands.
   • The exploit wires an inject node (fires at startup or on a schedule) to an exec node (runs shell commands), so the command runs as soon as the flow is deployed. The full exploit, flow and dropper arrived in a single POST /flows.
   • The source IP 4.201.105[.]116 (Microsoft AS8075, geolocated to Brazil) hit the Node-RED flaw 16 times between October 30 and November 1. It logged 125 hits against eight CVEs across VulnCheck's canary network, including the old Apache Solr flaw CVE-2019-17558 and targets such as Camunda, Gitea, MLflow, Traefik and Joomla.
   • One hit delivered a payload pointing to a separate download server, 85.215.73[.]250. This suggests a scan-and-infect setup in which the exploiting hosts pull the implant from a dedicated server.
   • The payload filename bot-linux-amd64 indicates a Linux AMD64 bot, and other builds may exist. Researchers did not retrieve the binary, so its behavior is unknown.

   Remediation

   • Check whether Node-RED instances, including those inside OT networks, are reachable from outside the network, and remove that exposure.
   • Apply available updates and implement detections for malicious flow deployment (POST /flows) and for the IOCs above.