EN PT-BR
← Voltar ao feed
critical critical infrastructure industrial control systems operational technology industrial manufacturing

Node-RED CVE-2026-58115 (CVSS 10) exploited in Siemens SIMATIC IoT2050 to drop Linux bot and persistent backdoors

4 fonte(s) · 4 atualização(ões) · publicado 02/11/2026 19:55 · coletado há 13 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 04/11/2026 00:00; os links antigos trazem para cá.

Fontes: helpnetsecurity.com ↗ securityweek.com ↗ thehackernews.com ↗ theregister.com ↗

VulnCheck reports active exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. Unauthenticated remote attackers can create malicious flows and run arbitrary code with maximum privileges (thehackernews.com, securityweek.com). Siemens published its advisory in August 2026 (thehackernews.com). A VulnCheck canary first caught exploitation on October 30, 2026, deploying a flow that pulled a Linux bot named bot-linux-amd64; later requests planted command backdoors and further payloads (helpnetsecurity.com, thehackernews.com). The source IP 4.201.105[.]116 sits in Microsoft AS8075, geolocates to Brazil, and hit the flaw 16 times between October 30 and November 1, which points to opportunistic mass scanning rather than targeted attacks (theregister.com, helpnetsecurity.com). VulnCheck added the flaw to its own KEV catalog, but CISA had not added it to its KEV as of the reporting (theregister.com, helpnetsecurity.com).

Entenda a falha

A vulnerabilidade

CVE-2026-58115 (CVSS 10.0) is a missing-authentication-for-a-critical-function flaw in the Node-RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. An unauthenticated remote attacker who can reach the interface can create malicious flows and run arbitrary code on the underlying system with maximum privileges. Versions before 4.3.4.1 are affected and 4.3.4.1 and later are fixed. VulnCheck reports active exploitation and added it to its own KEV; CISA had not listed it at the time of reporting. The Register and Help Net Security describe Node-RED exposure more broadly, while The Hacker News and SecurityWeek tie the flaw to the IoT2050 Advanced.

Como funciona

Node-RED is a flow-based tool in which chains of nodes react to events and can run system commands. On affected devices, the HTTP interface that accepts flow definitions does not require the caller to authenticate. A single POST /flows deploys a new flow, and an inject node wired to an exec node runs the command as soon as the flow is deployed, with no further interaction. The command runs on the device with maximum privileges. In the observed attacks, flows downloaded and ran a Linux bot from a separate server, or exposed an HTTP-in endpoint wired through a function node to an exec node, so commands could be sent later. The webshell survives a reboot, while the memory-resident bot does not.

Por que é vulnerável

The root cause is a missing authentication check on a critical function. Without adminAuth configured, the Node-RED editor, admin API and HTTP nodes can be used without credentials. Since Node-RED exists to run logic defined in flows, including shell commands, leaving it open amounts to remote code execution. The articles do not say why the problem went unnoticed. Siemens' mitigations point to the same cause: credential or OAuth/OpenID authentication for the editor and admin API, and basic authentication for HTTP nodes and the Dashboard. The fix ships in 4.3.4.1.

Como foi descoberta

SecurityWeek says Siemens found the flaw in its own SIMATIC IoT2050 Advanced devices and disclosed it on August 11, 2026 in an advisory; the articles do not say how it was found. On October 30, 2026, a VulnCheck canary caught an attacker exploiting it, and researcher Patrick Garrity called the request a complete exploit behind three layers of encoding. It came from an IP in Microsoft's AS8075 that geolocates to Brazil. SecurityWeek counts 15 further attacks by November 1, while The Register and Help Net Security say 16 hits in total from October 30 to November 1, which is consistent. The same IP hit eight CVEs in unrelated products, which Garrity reads as opportunistic mass scanning.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

A working exploit exists and has been seen only in attacks: VulnCheck says a single POST /flows carried the full exploit, flow and dropper, hidden behind three layers of encoding. Garrity says the inject and exec nodes make the flaw trivial to weaponize. The articles mention no published PoC; VulnCheck published only indicators of compromise. Because mass, automated exploitation is already under way, patch or remove external exposure now.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 00:16.

Detalhes técnicos

  • Affected devices do not enforce authentication on the Node-RED HTTP interface. Attackers scan for exposed instances lacking adminAuth and exploit them with a single HTTP request (theregister.com, securityweek.com).
  • The exploit wires an inject node to an exec node so the shell command runs as soon as the flow is deployed. The exploit, flow and dropper arrived in a single POST /flows, hidden behind three layers of encoding (theregister.com, thehackernews.com, helpnetsecurity.com).
  • The flow runs a shell wrapper that uses wget (with curl as fallback) to fetch an AMD64 bot binary from 85.215.73[.]250, saves it as /dev/shm/.b and runs it in the background. The command did not verify whether installation succeeded (thehackernews.com, securityweek.com).
  • Later requests moved to a two-stage process, fetching a second script wget.sh from the same server. Another request fetched a payload .sys_update from 45.194.90[.]57:38472, saved it as /tmp/.kworker (disguised as a kernel worker thread) and executed it (thehackernews.com).
  • Several requests deployed no downloader. Instead they created an HTTP-in endpoint (for example /cmd or a random path) wired through a function node to an exec node with addpay enabled, so commands can be run later via a query parameter. These webshells survive a reboot, unlike the memory-resident bot (thehackernews.com, helpnetsecurity.com).
  • The same IP logged 125 hits against eight CVEs across VulnCheck's canary network, including CVE-2019-17558 (Apache Solr) and targets such as Camunda, Gitea, MLflow, Traefik and Joomla (theregister.com, helpnetsecurity.com).
  • The binaries could not be retrieved, so the function of bot-linux-amd64, wget.sh and .kworker is unknown. The filename suggests builds for multiple architectures (securityweek.com, thehackernews.com).
  • Node-RED is widely used in ICS/OT and embedded in commercial products such as the SIMATIC IoT2050 (theregister.com).

Remediação

  • Update SIMATIC IoT2050 Advanced to version 4.3.4.1 or later (thehackernews.com, securityweek.com).
  • Alternatively uninstall Node-RED or harden it: require credential-based or OAuth/OpenID authentication for the editor and admin API, and basic authentication for HTTP nodes and the Node-RED Dashboard (thehackernews.com).
  • Check whether Node-RED instances, including those inside OT networks, are reachable from outside and remove that exposure (theregister.com, helpnetsecurity.com).
  • Hunt for unexpected flows, exec nodes and HTTP-in endpoints such as /cmd, the files /dev/shm/.b and /tmp/.kworker, and connections to the listed IPs. Detect POST /flows deployments. VulnCheck has published IOCs (thehackernews.com, securityweek.com, helpnetsecurity.com).

Relatos divergentes

  • Scope of affected products: theregister.com and helpnetsecurity.com describe the flaw as affecting Node-RED more broadly and other Siemens ICS/OT products, while thehackernews.com and securityweek.com tie it specifically to SIMATIC IoT2050 Advanced. The latter two cite the patched version, so they are more specific.
  • Attack count from the IP: securityweek.com says 15 additional attacks by November 1 after the first, while theregister.com and helpnetsecurity.com say 16 hits in total from October 30 to November 1. These are consistent if the first attempt is counted.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 03/11/2026 09:59 · coletado 03/11 12:02

    Node-RED Flaw CVE-2026-58115 Actively Exploited to Drop Linux Bot and Backdoors

    This article adds that the attacking IP geolocates to Brazil (despite being within Microsoft's network) and hit the Node-RED flaw 16 times between October 30 and November 1, while also logging 125 hits against 8 different CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, indicating opportunistic mass scanning rather than a targeted attack. It also names the dropped binary as **bot-linux-amd64** and notes VulnCheck added CVE-2026-58115 to its own KEV catalog while CISA had not done so yet.

    ler a análise desta fonte

    This article adds that the attacking IP geolocates to Brazil (despite being within Microsoft's network) and hit the Node-RED flaw 16 times between October 30 and November 1, while also logging 125 hits against 8 different CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, indicating opportunistic mass scanning rather than a targeted attack. It also names the dropped binary as bot-linux-amd64 and notes VulnCheck added CVE-2026-58115 to its own KEV catalog while CISA had not done so yet.

    VulnCheck researcher Patrick Garrity detailed active exploitation of CVE-2026-58115, a missing-authentication flaw in Node-RED that also affects Siemens ICS/OT products such as the SIMATIC IoT2050 Advanced. On October 30, 2026, a VulnCheck canary captured a complete exploit chain that deployed a malicious Node-RED flow, auto-triggered it, and pulled a binary named bot-linux-amd64 from an attacker-controlled server, all obfuscated behind three layers of encoding. The attacking IP, part of Microsoft's AS8075 and geolocating to Brazil, hit the Node-RED flaw 16 times between October 30 and November 1, and across VulnCheck's wider canary data logged 125 hits against 8 different CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, consistent with opportunistic mass scanning rather than a targeted campaign.

    Technical Details

    • The exploit wires a built-in inject node to an exec node so the flow runs a shell command automatically once deployed, with no further interaction needed.
    • The dropped binary (bot-linux-amd64) is stored under a hidden name in a memory-backed location (/dev/shm) and run in the background; VulnCheck could not retrieve the binary, so its exact function (cryptominer, DDoS bot, reverse shell, etc.) is unknown.
    • Later requests delivered additional payloads: a shell script from the same download server, and a separate file disguised as a kernel worker thread fetched from a second server.
    • Several requests installed persistent webshells allowing attackers to return and run commands at will; unlike the memory-resident bot, these survive a reboot.
    • VulnCheck added CVE-2026-58115 to its own KEV catalog after observing in-the-wild exploitation; as of publication, CISA had not added it to its KEV catalog.

    Remediation

    • Check today whether Node-RED instances, including those inside OT environments, are reachable from outside the network.
    • Apply available updates and implement detections to reduce exploitation risk.
    • IOCs including the attacker source IP and both payload server IPs are published by VulnCheck.
  2. securityweek.com ↗ · pub. 03/11/2026 09:10 · coletado 03/11 10:00

    Critical Node-RED Flaw (CVE-2026-58115) in Siemens SIMATIC IoT2050 Actively Exploited

    This article adds attribution detail showing the initial exploitation attempt on October 30, 2026 originated from an IP address within AS8075, Microsoft's network, and reports that by November 1, VulnCheck had observed 15 additional attacks from the same IP address delivering further payloads, including persistent webshells.

    ler a análise desta fonte

    This article adds attribution detail showing the initial exploitation attempt on October 30, 2026 originated from an IP address within AS8075, Microsoft's network, and reports that by November 1, VulnCheck had observed 15 additional attacks from the same IP address delivering further payloads, including persistent webshells.

    VulnCheck reports active in-the-wild exploitation of CVE-2026-58115 (CVSS 10/10), a missing-authentication vulnerability in the Node-RED HTTP interface used in Siemens SIMATIC IoT2050 Advanced devices. The flaw allows unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges on affected systems. VulnCheck first observed successful exploitation on October 30, 2026, from an IP address within AS8075, Microsoft's network, which deployed a Node-RED flow, triggered it automatically, and pulled a Linux bot binary from an attacker-controlled server behind three layers of encoding. By November 1, the same IP had conducted 15 additional attacks delivering further payloads, including persistent webshells enabling arbitrary command execution.

    Technical Details

    • The initial payload was a Linux bot; based on the filename, VulnCheck believes attackers built payloads for multiple architectures.
    • The execution command used did not verify whether installation succeeded.
    • Threat actors are actively scanning for internet-exposed Node-RED instances lacking adminAuth and exploiting them automatically via a single HTTP request.

    Remediation

    • Siemens has patched the issue in SIMATIC IoT2050 Advanced version 4.3.4.1 and later.
    • Organizations running Node-RED, including in ICS/OT environments, should verify whether it is reachable from outside the network and review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers leave webshells rather than bots.
  3. thehackernews.com ↗ · pub. 03/11/2026 02:34 · coletado 03/11 04:00

    Attackers Exploit Critical Siemens SIMATIC IoT2050 Node-RED Flaw (CVE-2026-58115) to Deploy Linux Bot and Command Backdoors

    ler a análise desta fonte

    VulnCheck reports active exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. An unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges. Siemens published its advisory in August 2026. VulnCheck first saw exploitation attempts against its honeypots as of October 30, 2026, aimed at downloading and running a Linux bot. Later requests planted persistent command backdoors that survive a reboot.

    Technical Details

    • The first exploit request deployed a Node-RED flow, triggered it automatically and pulled a binary from an attacker-controlled server, all behind three layers of encoding (Patrick Garrity, VulnCheck).
    • The flow runs a shell script wrapper that uses wget (with curl as fallback) to fetch an AMD64 botnet binary from 85.215.73[.]250. The binary is saved as /dev/shm/.b and executed.
    • The attackers then moved to a two-stage process in which wget retrieves a second script, wget.sh, from the same server.
    • Another request used wget/curl against 45.194.90[.]57:38472 to fetch a payload named .sys_update. It is saved as /tmp/.kworker, disguised as a kernel worker thread, and executed.
    • The functionality of wget.sh and .kworker is unknown because they could not be retrieved.
    • Several requests deployed no downloader. Instead the flow exposes an HTTP-in endpoint (for example /cmd or a randomly named path) wired through a function node to an exec node with addpay enabled. The attacker can run arbitrary commands later via a query parameter, and this backdoor persists even if a memory-backed implant is lost on reboot.

    Remediation

    • Update to version 4.3.4.1 or later.
    • Alternatively, uninstall Node-RED or harden it: secure the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and secure the HTTP nodes and Node-RED Dashboard with basic authentication.
    • Hunt for unexpected Node-RED flows, HTTP-in endpoints such as /cmd, and the files /dev/shm/.b and /tmp/.kworker. Check for connections to the listed IPs.
  4. theregister.com ↗ · pub. 02/11/2026 19:55 · coletado 02/11 21:00 primeiro registro

    Unknown actor exploits max-severity Node-RED flaw CVE-2026-58115 to deploy Linux bot via malicious flows

    ler a análise desta fonte

    VulnCheck reports that an unknown actor is exploiting CVE-2026-58115, a CVSS 10.0 flaw in Node-RED, to deploy a flow that downloads and runs a Linux bot. Node-RED is widely used for workflow automation in ICS/OT environments and is embedded in commercial products such as the Siemens SIMATIC IoT2050. A VulnCheck canary caught an attacker exploiting the flaw on October 30, 2026. The activity came from a single IP that also probed other products, which suggests opportunistic mass scanning rather than targeted attacks. The flaw is in VulnCheck's KEV catalog but, as of publication, not in CISA's KEV.

    Technical Details

    • Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface. Unauthenticated remote attackers can create malicious flows that execute system commands.
    • The exploit wires an inject node (fires at startup or on a schedule) to an exec node (runs shell commands), so the command runs as soon as the flow is deployed. The full exploit, flow and dropper arrived in a single POST /flows.
    • The source IP 4.201.105[.]116 (Microsoft AS8075, geolocated to Brazil) hit the Node-RED flaw 16 times between October 30 and November 1. It logged 125 hits against eight CVEs across VulnCheck's canary network, including the old Apache Solr flaw CVE-2019-17558 and targets such as Camunda, Gitea, MLflow, Traefik and Joomla.
    • One hit delivered a payload pointing to a separate download server, 85.215.73[.]250. This suggests a scan-and-infect setup in which the exploiting hosts pull the implant from a dedicated server.
    • The payload filename bot-linux-amd64 indicates a Linux AMD64 bot, and other builds may exist. Researchers did not retrieve the binary, so its behavior is unknown.

    Remediation

    • Check whether Node-RED instances, including those inside OT networks, are reachable from outside the network, and remove that exposure.
    • Apply available updates and implement detections for malicious flow deployment (POST /flows) and for the IOCs above.