Attackers are hijacking open Node-RED editors to plant bots. Siemens IoT2050 owners must update; everyone else, turn on adminAuth

A maximum-severity flaw in Siemens' SIMATIC IoT2050 Advanced industrial gateways is being exploited to install bot malware, according to threat-intelligence firm VulnCheck, whose decoy systems caught the first attack on October 30. The bug, CVE-2026-58115, is simple: on affected devices, the bundled Node-RED low-code automation editor answers on the network without asking for a password, so anyone who can reach it can deploy a "flow" that runs shell commands with full privileges.

Why it matters beyond Siemens: the attack doesn't use a clever exploit. It uses Node-RED's normal admin API. Node-RED's own documentation says that by default, the editor is not secured and that this is "only suitable if you are running on a trusted network." HOL's analysis of the attack notes that the same request works against any Node-RED instance without its adminAuth setting configured — and that no Node-RED software update will fix that for you.

What's affected

According to the CVE record Siemens filed in August:

When the CVE was published on August 11, CISA's enrichment recorded no known exploitation but rated it automatable with "total" technical impact. That changed at the end of October.

What the attackers did

Based on VulnCheck's findings, as reported by Security Point Break and HOL:

• A single POST /flows request deploys a flow containing an inject node and an exec node. The exec node decodes a base64 command that downloads a binary named bot-linux-amd64 into RAM-backed storage (/dev/shm/.b) and starts it.
• Later requests used a second payload server, dropped files at /tmp/.s and /tmp/.kworker, and installed HTTP-triggered webshell flows that Security Point Break says persist across reboots.
• One source address in Microsoft's cloud range sent 16 attacks between October 30 and November 1, and has also probed bugs in Apache Solr, Gitea, MLflow and Joomla. VulnCheck reportedly considers it a compromised or rented VM, which points to opportunistic mass scanning rather than a targeted campaign.
• VulnCheck did not retrieve the bot binary, so its capabilities are unknown.

Security Point Break reported that the CVE was not yet in CISA's Known Exploited Vulnerabilities catalog as of November 2.

What to do

If you run a SIMATIC IoT2050 Advanced:

1. Update Industrial OS to V4.3.4.1 or later via Siemens Industry Online Support (Siemens advisory SSA-834709).
2. If you don't use Node-RED on the device, Siemens' alternative is to uninstall it.

If you run Node-RED anywhere — Raspberry Pi, a server, a Docker container, another vendor's gateway:

1. Test whether your editor is open. HOL suggests running curl --max-time 10 http://<host>:1880/auth/login from another machine. An empty {} means no login is configured; a response mentioning "credentials" or "strategy" means adminAuth is on.

2. Turn on adminAuth in settings.js. Generate a password hash with:

   node-red admin hash-pw

   then add a user with that hash under adminAuth (type "credentials"), and restart Node-RED. The Node-RED docs show the format, including read-only users.

3. Protect HTTP endpoints too. adminAuth covers the editor; flows exposed through HTTP In nodes need httpNodeAuth (or your own auth) separately. Enable https in settings if the editor crosses any network you don't fully trust.
4. Keep port 1880 off the internet and off flat OT networks; allow only engineering workstations.

If you think you've been hit: look for exec or http in nodes you didn't create, flows that were replaced wholesale, and the files /dev/shm/.b, /tmp/.s or /tmp/.kworker. HOL recommends isolating and rebuilding the host and rotating any credentials stored in Node-RED, because simply deleting a rogue exec node leaves the admin API open for the attacker to return.

What to watch

Node-RED is embedded in other industrial products; Security Point Break reports that VulnCheck has not confirmed whether other vendors' devices that ship it are affected. Expect more scanning of port 1880 now that a working, trivial technique is public — and a possible CISA KEV listing, which would put a federal patch deadline on the Siemens bug.