Node-RED unauthenticated flow injection exploited to drop Linux bot on OT/ICS devices (CVE-2026-58115)
Severity: critical · Patch status: patched · Since 2026-11-02 · CVE-2019-17558, CVE-2026-58115
Unknown criminals are exploiting CVE-2026-58115, a CVSS 10.0 flaw in Node-RED, a flow-based programming tool widely used in ICS/OT environments and embedded in products like Siemens SIMATIC IoT2050. Affected devices do not enforce authentication on the Node-RED HTTP interface, letting unauthenticated remote attackers deploy malicious flows. Using built-in inject and exec nodes, attackers trivially execute shell commands on deployment. On 2026-10-30 VulnCheck's canary caught an attacker (IP 4.201.105[.]116, Microsoft AS8075, geolocating to Brazil) sending a complete exploit via POST /flows, delivering a dropper for a Linux AMD64 bot (bot-linux-amd64). The same IP logged 125 hits against eight CVEs including old Apache Solr CVE-2019-17558, indicating opportunistic mass scanning rather than a targeted attack. A second host (85.215.73[.]250) serves the payload, suggesting a scan-and-infect setup. The bug is in VulnCheck's KEV but not yet CISA's KEV. Fixes/updates are available; admins should verify exposure and patch.
What to do
- Check immediately whether any Node-RED instance, especially in OT/ICS networks, is reachable from the internet and restrict access (firewall, VPN, bind to localhost)
- Apply available Node-RED/Siemens updates addressing CVE-2026-58115
- Enforce authentication on the Node-RED HTTP admin interface
- Block/monitor for the known attacker IPs 4.201.105[.]116 and 85.215.73[.]250 and watch for POST /flows requests and bot-linux-amd64 artifacts
- Deploy detection rules for suspicious flow deployments and exec-node usage; review devices for compromise
Sources
All live incidents on Threat Watch
