A critical flaw (CVSS 10.0) exploited in real-world conditions

Siemens documented on August 11, 2026, a missing authentication vulnerability (CVE-2026-58115) in Node-RED, an event-driven programming tool integrated into its SIMATIC IoT2050 Advanced equipment running on Industrial OS. According to the vendor, this flaw allows an unauthenticated attacker to create malicious flows and execute system commands with maximum privileges via Node-RED’s HTTP interface.

The flaw’s severity is maximal, with a CVSS score of 10.0, and it affects versions prior to 4.3.4.1, for which Siemens has released patches. The vendor also recommends either uninstalling Node-RED or hardening its installation to mitigate risks.

Attackers used a single POST request to deliver a three-layer encoded dropper, downloading a binary from a remote server while evading traditional detection mechanisms.

Automated attacks targeting exposed Internet-facing systems

VulnCheck observed active exploitation of this flaw since October 30, 2026, originating from an IP address (4.201.105[.]116) within the Microsoft network (AS8075), geolocated in Brazil. Attackers deployed a malicious Node-RED flow capable of downloading and executing a Linux binary named bot-linux-amd64, stored in memory (/dev/shm/.b) and running in the background with elevated privileges.

According to VulnCheck’s analysis, attacks followed a three-step method: defining a Node-RED flow, triggering it automatically, then downloading a payload from a server controlled by the attacker, all encoded in three layers to evade detection. Between October 30 and November 1, the same IP targeted the flaw 16 times, while scanning other vulnerabilities (such as CVE-2019-17558) across various products, suggesting an opportunistic scanning campaign.

Additionally, some attackers created HTTP endpoints (such as /cmd) to enable arbitrary command execution via query parameters, according to observations reported by VulnCheck.

Node-RED: a widely deployed tool in industrial and critical environments

Node-RED is a flow-based (flow-based) programming tool used to create event-driven applications via a web interface. It is integrated into industrial equipment and ICS/OT systems (Industrial Control Systems/Operational Technology), including those from Siemens such as the SIMATIC IoT2050 Advanced. According to Daily Security Review, more than 20,000 Node-RED management interfaces may be exposed on the Internet, making them a prime target for attackers.

The CVE-2026-58115 vulnerability exploits a gap in Node-RED’s administration API, allowing unauthenticated access to nodes capable of executing system commands. Attackers have leveraged this flaw to deploy persistent Linux bots and webshells, as confirmed by Patrick Garrity of VulnCheck: « The attacker used a single POST request to deliver a three-layer encoded dropper, downloading a binary from a remote server ».

What this means here: risks for critical infrastructures in Benin and West Africa

Companies and government agencies in Benin and West Africa using industrial equipment or ICS/OT systems integrating Node-RED could be exposed to similar attacks, particularly if their installations are outdated or if Node-RED is accessible from outside their network. The most affected sectors include power plants, processing plants, water distribution networks, and oil infrastructure, where industrial control systems (SCADA) often rely on tools like Node-RED for automation.

If SIMATIC IoT2050 Advanced equipment or other platforms embedding Node-RED are deployed without enhanced authentication, organizations could suffer advanced intrusions, such as the installation of persistent Linux bots or webshells enabling prolonged remote access. Observed attacks show that attackers systematically target systems exposed on the Internet, underscoring the importance of segmenting industrial networks and limiting external access to management interfaces.

To protect themselves, IT and OT professionals should check the version of their Siemens equipment and apply available patches (version 4.3.4.1 or higher). Otherwise, they may consider disabling Node-RED or configuring it with strict authentication, as Siemens recommends. Enhanced monitoring of incoming traffic and log analysis to detect suspicious POST requests to the /flows endpoint could also help mitigate risks.