Node-RED flaw in Siemens devices is now being exploited
VulnCheck detected exploitation of the critical CVE-2026-58115 flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced devices. Siemens released a fix in version V4.3.4.1.
The Node-RED flaw CVE-2026-58115, with the maximum CVSS score of 10.0, was reportedly exploited against VulnCheck’s monitoring canary system. The vulnerability affects SIMATIC IoT2050 Advanced devices with Industrial OS and Node-RED installed. Siemens released a fix in version V4.3.4.1.
Siemens describes the vulnerability as missing authentication in the Node-RED HTTP interface. According to the advisory, an unauthenticated remote attacker can create a malicious flow and execute arbitrary code with maximum privileges. SIMATIC IoT2050 Advanced versions older than V4.3.4.1 are affected.
The Node-RED flaw was detected in a canary environment
VulnCheck said it recorded a complete exploitation of the vulnerability in its canary system on October 30. The attack deployed a flow designed to download and execute a Linux binary. According to VulnCheck telemetry, a single HTTP request was enough to exploit the flaw.
By November 1, the company had recorded 15 additional attempts from the same IP address. The observed variants included flows creating persistent webshell interfaces. VulnCheck identified the downloaded binary as a bot, but its function was not independently verified.
The IP address used in the attempts belonged to Microsoft’s ASN. This circumstance alone does not confirm Microsoft’s involvement or the attacker’s identity.
Affected configurations and the fix
The flaw does not automatically affect every device in the IoT2050 series. According to Siemens, it is relevant to the SIMATIC IoT2050 Advanced model when it uses Industrial OS and has Node-RED installed. Organizations should verify both the system version and the presence of this component.
Siemens fixed the issue in version V4.3.4.1 and later. For systems that cannot yet be updated, the manufacturer recommends removing Node-RED or restricting network access to the device. Checking installations accessible from the internet is particularly important.
Administrators should also check for unexpected exec nodes in Node-RED flows and unknown HTTP endpoints, which may indicate an attempt to establish persistent remote access.
Confirmed exploitation, but no confirmed incidents in operational environments
The observed attacks are confirmed against VulnCheck’s canary infrastructure. There is no confirmation that they resulted in the compromise of real industrial operations or customer devices. However, the finding shows that the flaw was practically exploited in a test monitoring system.
The risk is particularly relevant in OT environments. A compromised edge device could provide an attacker with a point for remotely executing commands and deploying persistent access in the operational network.
Further developments will show whether CVE-2026-58115 is added to the CISA Known Exploited Vulnerabilities catalog, whether independently confirmed compromises outside canary systems emerge, and whether Siemens adds further indicators of compromise to its advisory.
Sources
- Siemens ProductCERT — SSA-834709 – Confirms the scope of affected versions, CVSS 10.0, the possibility of unauthenticated code execution, the V4.3.4.1 fix, and recommended mitigations.
- VulnCheck Blog – VulnCheck states that its canary detected exploitation of CVE-2026-58115 on October 30, deploying a flow that downloaded and executed a Linux binary.
- SecurityWeek – Corroborates VulnCheck telemetry about additional attempts from the same IP address, payload variants, and persistent webshells.
Verified and updated: 11/03/2026 16:18
