Attackers are exploiting CVE-2026-58115, a maximum-severity missing-authentication flaw in Node-RED, to run code on exposed systems and install Linux malware, according to an advisory from VulnCheck. The bug also affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS.
Unauthenticated Flow Creation Gives Attackers Full Privileges
CVE-2026-58115 carries a CVSS score of 10.0. The flaw sits in the Node-RED HTTP interface, where a missing authentication check lets an unauthenticated remote attacker create malicious flows and run code with maximum privileges. Siemens published its advisory in August and fixed the problem in version 4.3.4.1 or later. The company recommends uninstalling Node-RED or hardening it.
More than 20,000 Node-RED management interfaces are reportedly exposed to the internet. No standalone public proof-of-concept exploit has been published.
How the First Exploit Delivered a Linux Bot
VulnCheck said its canary system caught exploitation on October 30. The attacker sent a complete exploit in a single POST /flows request. An inject node wired to an exec node ran a three-layer encoded dropper, which pulled a Linux binary named bot-linux-amd64 from 85.215.73[.]250 using wget, with curl as a fallback. The file was saved as /dev/shm/.b.
Later Attempts Switched Payloads and Added Webshells
Subsequent attempts changed approach. The attacker moved to a two-stage script, wget.sh, and fetched a payload from 45.194.90[.]57:38472 that was saved as /tmp/.kworker. Reporting on the advisory also describes webshells deployed through HTTP input endpoints. VulnCheck did not retrieve the binary, so what it does is unknown.
One Microsoft-Hosted IP Behind Opportunistic Scanning
All of the exploit traffic VulnCheck observed came from a single address, 4.201.105[.]116, which sits in Microsoft’s AS8075 and geolocates to Brazil. Between October 30 and November 1 it hit the Node-RED flaw 16 times. It also logged 125 hits across eight CVEs in total, including CVE-2019-17558, a 2019 Apache Solr bug.
The mix of old and new vulnerabilities points to opportunistic mass scanning rather than a campaign aimed at industrial targets specifically. An attacker working through a list of known flaws needs only that a reachable service be vulnerable, whatever it controls.
Why Exposed Node-RED Instances Carry Outsized Risk
Node-RED is a widely used programming tool for wiring together devices and services, which means a compromised instance often sits close to the equipment it orchestrates. On Siemens IoT2050 gateways, that position is inside industrial networks. A shell with maximum privileges on such a device gives an attacker a foothold for botnet enrollment or movement toward neighboring systems.
The timeline also shows a gap. Siemens fixed the flaw in August, and exploitation was observed about two months later against systems that had not applied the update or had left the interface open to the internet. Fixed bugs in exposed management interfaces tend to be exploited soon after public details appear, even without a published exploit, because the description of a missing-authentication flaw is enough for attackers to build one.
What VulnCheck and Siemens Recommend
VulnCheck urged organizations to check whether Node-RED is reachable externally, apply updates and enforce authentication. Siemens points to version 4.3.4.1 or later, or removal of the software.
The unknown function of the bot binary leaves the end goal unclear. Without a retrieved sample, it is not possible to say whether the payload is a denial-of-service tool, a proxy or something else. What is established is the delivery chain and the infrastructure used, which gives defenders addresses and file paths to search for on exposed hosts.
Indicators Defenders Can Search For
The published details give administrators concrete items to hunt for on Node-RED hosts: the file /dev/shm/.b, the later /tmp/.kworker payload, the wget.sh script, and outbound connections to 85.215.73[.]250 and 45.194.90[.]57 on port 38472. Because the initial exploit is a single POST /flows request, web logs on exposed instances may also show that request from 4.201.105[.]116.
The single-request design is also notable for what it avoids. The attacker needed no login, no staged reconnaissance and no second connection to establish code execution, so the window between a scanner finding an exposed interface and a bot running on it can be seconds.
