Node-RED Critical Vulnerability Faces Exploits Attempting Malware Execution
Smart operations
Security firm VulnCheck disclosed active exploitation targeting Node-RED critical flaw CVE-2026-58115, where attackers attempt to execute Linux malware and deploy web shells for persistence. Scoring 10.0 on CVSS, the flaw also affects Siemens SIMATIC IoT2050 gateways, prompting security patch advisories.
Cybersecurity firm VulnCheck detected active exploitation targeting critical vulnerability CVE-2026-58115 in Node-RED, an open-source low-code development tool widely used across industrial control systems (ICS) and operational technology (OT) environments. Attackers leverage unauthenticated management interfaces to deploy malicious flows with command execution nodes, downloading Linux malware and establishing web shells for persistent remote access. Node-RED's CVSS severity score reaches 10.0. Siemens previously warned that its SIMATIC IoT2050 Advanced industrial IoT gateways running specific versions with Node-RED could allow attackers to execute arbitrary code with highest privileges. Experts advise administrators to ensure management interfaces are not exposed to the public internet, audit for unauthorized flows, and apply vendor updates or mitigation measures.
Key takeaways
- VulnCheck observed active exploitation of Node-RED vulnerability CVE-2026-58115 attempting to install Linux malware and web shells.
- The flaw stems from unauthenticated management interfaces, allowing automated malicious command execution and scoring 10.0 on CVSS.
- Siemens SIMATIC IoT2050 Advanced gateways are affected; Siemens advises upgrading to V4.3.4.1 or applying mitigations.
- Researchers observed 16 attack attempts since October 30, urging administrators to audit exposed interfaces and unauthorized nodes.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.