Security
Attackers are hijacking open Node-RED editors to plant bots. Siemens IoT2050 owners must update; everyone else, turn on adminAuth
A CVSS 10 missing-authentication flaw in Siemens' SIMATIC IoT2050 Advanced gateways, CVE-2026-58115, is now being exploited, according to threat-intel firm VulnCheck. The attack is a single request to Node-RED's admin API, so any Node-RED instance left without a password is exposed in the same way.