Node-RED CVE-2026-58115 exploited to drop Linux bot in OT

1. Executive summary

On 30 October 2026 a VulnCheck canary recorded an attacker exploiting CVE-2026-58115, a missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices, rated CVSS 10.0 critical and not in CISA KEV, to deploy a flow that downloads and runs a Linux bot. The activity came from a single IP address and, by VulnCheck's own reading, is opportunistic mass scanning rather than a targeted campaign. Node-RED is used for workflow automation in ICS and OT environments, so any EMEA financial services estate that exposes Node-RED, including through building-management or test-lab OT, carries the exposure. The immediate risk is unauthenticated remote code execution on internet-reachable instances; the malware's post-execution behaviour is unknown because VulnCheck did not retrieve the binary. Separately, the same scanning IP hit CVE-2019-17558, an Apache Solr flaw that is in CISA KEV with EPSS 99%, which raises the priority of that older exposure.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-58115 is a missing-authentication flaw (CWE-306) in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices. The devices do not enforce authentication on that interface, which gives unauthenticated access to programming nodes that can execute system commands. Siemens assigned the identifier in August 2026. NVD records the flaw at CVSS 10.0 critical; it is not in CISA KEV and EPSS stands at 1%.

The confirmed steps VulnCheck documented are:

1. The attacker sends a single HTTP POST to the Node-RED /flows endpoint containing the complete exploit, flow and dropper. No prior authentication is required.
2. The deployed flow wires a Node-RED inject node to an exec node. The inject node fires a message on a schedule or once at startup; the exec node runs shell commands. Wired together, the flow executes a command as soon as it is deployed, with no further interaction.
3. The command downloads a Linux bot. The filename observed is bot-linux-amd64, which indicates the malware targets Linux on AMD64 processors and suggests the operator may hold other builds.
4. The implant is pulled from a separate server from the one that sent the exploit. VulnCheck assesses this as a scan-and-infect arrangement: hosts that find and exploit vulnerable instances fetch the implant from a dedicated download server.

VulnCheck did not retrieve the binary or staged scripts, so the malware's capabilities once running are not stated in public reporting. Persistence, privilege escalation, command-and-control protocol, lateral movement and any data access are all unknown for the same reason. The bot-linux-amd64 name and the separate download host are the only indicators of the implant's role.

The activity came from a single IP address, 4.201.105[.]116, in Microsoft's AS8075 network, geolocating to Brazil. Between 30 October and 1 November 2026 VulnCheck saw this address target the Node-RED vulnerability 16 times and log 125 hits against eight different CVEs across its wider canary network. One of those hits delivered a different payload pointing to a separate server, 85.215.73[.]250, which VulnCheck tracks but has no telemetry on beyond the URL. The same address also hit CVE-2019-17558, a seven-year-old Apache Solr flaw affecting Camunda, Gitea, MLflow, Traefik and Joomla alongside Node-RED. CVE-2019-17558 is in CISA KEV (added 2021-11-03), carries CVSS 7.5 high and EPSS 99%, and is recorded under CWE-74. The mix of old and new bugs across unrelated products is what leads VulnCheck to call the activity opportunistic mass scanning rather than a targeted attack.

Attribution is unconfirmed. No actor is named in the reporting, and the single source IP is infrastructure, not an identity. The claim that the activity is opportunistic rests on one vendor's canary telemetry (single-sourced; verify before relying on it for scoping). The two IP addresses and the download-host arrangement are likewise single-sourced to VulnCheck.

4. Mitigation & containment

P1 (within 24 hours)

• Determine whether any Node-RED instance, including inside OT environments, is reachable from outside the network. VulnCheck's own guidance is to check this first.
• Block inbound access to Node-RED HTTP interfaces at the perimeter and remove any internet exposure of /flows. Restrict management access to a segmented management network.
• Apply updates where available. No fixed release version is named in public reporting; confirm the fix status and version with Siemens for SIMATIC IoT2050 Advanced devices rather than assuming one.
• Hunt for POST requests to /flows from 4.201.105[.]116 and for outbound fetches to 85.215.73[.]250, and for files named bot-linux-amd64 on any Node-RED host.
• Treat any host that received a deployed flow as compromised: isolate it, capture the flow definition and any dropped file, and preserve them for analysis.

P2 (within 72 hours)

• Inventory every Node-RED deployment in the estate, including embedded copies in commercial products, and record which are supplier-supported and at what version.
• Where Node-RED cannot be patched immediately, disable or restrict the exec node and remove the ability to deploy flows from unauthenticated sessions, and pin the deployment to a known-good flow set.
• Review CVE-2019-17558 exposure on any Apache Solr instance, since the same scanning source hit it and it is in CISA KEV with EPSS 99%. Patch or isolate Solr endpoints that are internet-reachable.

P3 (within 7 days)

• Add detection for the flow-deployment pattern in §6 to OT and IT monitoring, and alert on any new flow deployment on production Node-RED instances.
• Confirm with the supplier the patch path for the embedded Node-RED component and record it against the third-party risk register.

5. Indicators of compromise

ipv4  4.201.105[.]116
ipv4  85.215.73[.]250
filename  bot-linux-amd64

Behavioural indicators

6. Detection

rule NodeRED_Linux_Bot_Dropper_Flow
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-03"
        reference = "https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086"
        description = "Detects Node-RED flow artefacts referencing the bot-linux-amd64 dropper and exec node command execution"
    strings:
        $bot = "bot-linux-amd64"
        $exec = "\"type\":\"exec\""
        $inject = "\"type\":\"inject\""
    condition:
        $bot and 1 of ($exec, $inject)
}

title: Node-RED Flow Deployment with Exec Node Command Execution
id: 8f3c2a1e-6b4d-4c9a-9e21-7d5f0a3b6c12
status: experimental
description: Detects deployment of a Node-RED flow that wires an inject node to an exec node, the pattern used to exploit CVE-2026-58115
author: Adverse Trace
date: 2026-11-03
references:

  - https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem: /flows
  condition: selection
falsepositives:

  - Legitimate authenticated flow deployments by administrators
level: high

CVE assessment

2 referenced CVEs — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• The Register, "Max-severity bug in widely used OT programming tool exploited to deliver Linux malware", https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086, 2026-11-02
• The Hacker News, "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors", https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

8. Adverse Trace position

Adverse Trace assesses CVE-2026-58115 as CVSS 10.0 critical, not in CISA KEV, EPSS 1%, and exploited in the wild per VulnCheck. The exploitation is single-sourced to VulnCheck's canary telemetry and is characterised by that vendor as opportunistic mass scanning, not a targeted campaign; we treat the attribution as unconfirmed and the indicators as single-sourced, to be verified before enforcement. For EMEA financial services the client impact is low where no Node-RED instance is internet-reachable and rises sharply where OT or building-management Node-RED is exposed, because the flaw gives unauthenticated command execution and the dropped binary's behaviour is unknown. The concurrent CVE-2019-17558 hits matter more for many estates given its CISA KEV status and EPSS 99%. We will monitor for a Siemens fix version and for further VulnCheck telemetry on the download host, and will update this advisory if either appears. Clients should confirm Node-RED exposure today and report back any instance reachable from outside the network.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.