# Attackers are hijacking open Node-RED editors to plant bots. Siemens IoT2050 owners must update; everyone else, turn on adminAuth

> A CVSS 10 missing-authentication flaw in Siemens' SIMATIC IoT2050 Advanced gateways, CVE-2026-58115, is now being exploited, according to threat-intel firm VulnCheck. The attack is a single request to Node-RED's admin API, so any Node-RED instance left without a password is exposed in the same way.

Published Nov 3, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/node-red-cve-2026-58115-exploited-siemens-iot2050-adminauth-what-to-do

A maximum-severity flaw in Siemens' **SIMATIC IoT2050 Advanced** industrial gateways is being exploited to install bot malware, according to threat-intelligence firm **VulnCheck**, whose decoy systems caught the first attack on **October 30**. The bug, **CVE-2026-58115**, is simple: on affected devices, the bundled **Node-RED** low-code automation editor answers on the network without asking for a password, so anyone who can reach it can deploy a "flow" that runs shell commands with full privileges.

Why it matters beyond Siemens: the attack doesn't use a clever exploit. It uses Node-RED's normal admin API. Node-RED's own documentation says that **by default, the editor is not secured** and that this is "only suitable if you are running on a trusted network." HOL's analysis of the attack notes that the same request works against any Node-RED instance without its `adminAuth` setting configured — and that no Node-RED software update will fix that for you.

## What's affected

According to the CVE record Siemens filed in August:

| | |
|---|---|
| Product | SIMATIC IoT2050 Advanced (article no. 6ES7647-0BA00-1YA2) |
| Condition | Running Industrial OS **with Node-RED installed** |
| Affected | All versions before **V4.3.4.1** |
| Severity | CVSS 10.0 (both v3.1 and v4.0); CWE-306, missing authentication |

When the CVE was published on August 11, CISA's enrichment recorded **no known exploitation** but rated it automatable with "total" technical impact. That changed at the end of October.

## What the attackers did

Based on VulnCheck's findings, as reported by Security Point Break and HOL:

- A single `POST /flows` request deploys a flow containing an *inject* node and an *exec* node. The exec node decodes a base64 command that downloads a binary named `bot-linux-amd64` into RAM-backed storage (`/dev/shm/.b`) and starts it.
- Later requests used a second payload server, dropped files at `/tmp/.s` and `/tmp/.kworker`, and installed HTTP-triggered webshell flows that Security Point Break says **persist across reboots**.
- One source address in Microsoft's cloud range sent **16 attacks between October 30 and November 1**, and has also probed bugs in Apache Solr, Gitea, MLflow and Joomla. VulnCheck reportedly considers it a compromised or rented VM, which points to opportunistic mass scanning rather than a targeted campaign.
- VulnCheck did not retrieve the bot binary, so its capabilities are unknown.

Security Point Break reported that the CVE was not yet in CISA's Known Exploited Vulnerabilities catalog as of November 2.

## What to do

**If you run a SIMATIC IoT2050 Advanced:**

1. Update Industrial OS to **V4.3.4.1 or later** via Siemens Industry Online Support (Siemens advisory SSA-834709).
2. If you don't use Node-RED on the device, Siemens' alternative is to uninstall it.

**If you run Node-RED anywhere — Raspberry Pi, a server, a Docker container, another vendor's gateway:**

1. **Test whether your editor is open.** HOL suggests running `curl --max-time 10 http://<host>:1880/auth/login` from another machine. An empty `{}` means no login is configured; a response mentioning `"credentials"` or `"strategy"` means `adminAuth` is on.
2. **Turn on `adminAuth`** in `settings.js`. Generate a password hash with:

   ```
   node-red admin hash-pw
   ```

   then add a user with that hash under `adminAuth` (type `"credentials"`), and restart Node-RED. The Node-RED docs show the format, including read-only users.
3. **Protect HTTP endpoints too.** `adminAuth` covers the editor; flows exposed through *HTTP In* nodes need `httpNodeAuth` (or your own auth) separately. Enable `https` in settings if the editor crosses any network you don't fully trust.
4. **Keep port 1880 off the internet** and off flat OT networks; allow only engineering workstations.

**If you think you've been hit:** look for exec or *http in* nodes you didn't create, flows that were replaced wholesale, and the files `/dev/shm/.b`, `/tmp/.s` or `/tmp/.kworker`. HOL recommends isolating and rebuilding the host and rotating any credentials stored in Node-RED, because simply deleting a rogue exec node leaves the admin API open for the attacker to return.

## What to watch

Node-RED is embedded in other industrial products; Security Point Break reports that VulnCheck has not confirmed whether other vendors' devices that ship it are affected. Expect more scanning of port 1880 now that a working, trivial technique is public — and a possible CISA KEV listing, which would put a federal patch deadline on the Siemens bug.


## Sources

1. [CVE Program — CVE-2026-58115 record (Siemens SIMATIC IoT2050 Advanced)](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58115.json)
2. [Node-RED documentation — Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red)
3. [Security Point Break — Node-RED flaw in Siemens IoT2050 exploited (CVE-2026-58115)](https://securitypointbreak.com/2026/11/02/node-red-flaw-siemens-iot2050-exploited-cve-2026-58115/)
4. [HOL — CVE-2026-58115 Node-RED no-login exploited: IoT2050 fix and adminAuth check](https://hol.org/blog/cve-2026-58115-node-red-no-login-exploited-siemens-iot2050)