What happened

• CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw in the Node-RED HTTP interface [S1][S2].
• VulnCheck first observed exploitation on October 30, 2026, from a single IP in AS8075 [S1].
• The exploit deploys a malicious flow and triggers it automatically. The flow runs a shell wrapper that uses wget, with curl as fallback, to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it [S1][S2].
• By November 1, the same IP had made 15 more attacks delivering persistent webshells. These are HTTP-in endpoints such as /cmd wired to exec nodes [S1][S2].
• The observations come from honeypots. No confirmed victim compromises are reported [S2].
• S2 frames the flaw as specific to SIMATIC IoT2050 Advanced. S1 frames it as a Node-RED flaw [S1][S2].

Timeline

Detect

Node-RED spawning shell or downloader · Linux host process events (EDR, auditd or Sysmon for Linux)

index=* (parent_process_name="node" OR parent_process_name="node-red" OR parent_process="*node-red*") process_name IN ("sh","bash","wget","curl") | stats count min(_time) as first max(_time) as last values(process) as cmdlines by host parent_process_name process_name

A hit means: A Node-RED process launched a shell or a downloader. This matches the flow-triggered wget/curl bot fetch [S1][S2]. Treat it as likely compromise unless a known flow uses exec.

Flow deployment via admin API · Node-RED HTTP access logs / reverse proxy or web logs

index=* (uri_path="/flows" OR uri="*/flows*") (http_method="POST" OR method="POST") | stats count min(_time) as first max(_time) as last values(src_ip) as src by host uri_path status

A hit means: Someone deployed flows through the admin API. Deploys from external or unknown sources match the exploitation pattern [S2]. Check them against change records.

Execution from /dev/shm/.b or /tmp/.kworker · Linux host process and file events

index=* (process="/dev/shm/.b*" OR process="/tmp/.kworker*" OR process_path="/dev/shm/*" OR file_path="/dev/shm/.b" OR file_path="/tmp/.kworker") | stats count min(_time) as first values(process) as cmdlines values(parent_process_name) as parents by host

A hit means: A file was written to, or executed from, the bot drop paths reported for this campaign [S2]. Treat it as probable bot installation.

Requests to HTTP-in command endpoints · Node-RED HTTP access logs / reverse proxy or web logs

index=* (uri_path="/cmd" OR uri="*/cmd?*") | stats count min(_time) as first max(_time) as last values(src_ip) as src values(http_method) as methods by host uri_path status

A hit means: Something requested a /cmd-style endpoint. This may be a webshell backdoor wired to an exec node [S2]. Endpoint names can vary, so a miss is not clearance.

Verify

• Export the deployed flows. Look for exec nodes, and for HTTP-in nodes that feed them which no owner can explain [S1].
• Confirm whether the flow deploy came from an unauthenticated external source, and whether adminAuth was absent at that time [S1].
• Check /dev/shm and /tmp for hidden executables such as .b and .kworker. Hash them and preserve them [S2].
• Benign look-alike: legitimate flows that use exec nodes or wget/curl for automation.
• Benign look-alike: authorised engineers deploying flows through the editor or admin API.
• Benign look-alike: kernel kworker threads. These are not files in /tmp.

Scope

Affected

• Node-RED HTTP interface lacking authentication (CVE-2026-58115) [S1]
• Siemens SIMATIC IoT2050 Advanced devices with Node-RED [S2]

Only if

• Node-RED has no adminAuth configured [S1]
• The Node-RED HTTP interface is reachable from the internet or an untrusted network [S1]

Not affected if

• adminAuth is enabled on Node-RED [S1]
• Node-RED is not reachable from outside the network [S1]

Fixed in: SIMATIC IoT2050 Advanced 4.3.4.1 and later, per pipeline exposure data. This is not stated in the S1/S2 summaries; confirm it against the Siemens advisory.

Enumerate

• All Node-RED instances: servers, containers, IoT/OT gateways and SIMATIC IoT2050 devices, including those in facilities and building systems.
• Which instances are reachable from the internet or untrusted segments (external attack surface scan).
• The adminAuth setting in each instance's settings.js.
• The IoT2050 firmware version on each device.
• Deployed flows containing exec nodes or HTTP-in endpoints, on every instance.

Contain

• Remove internet and untrusted-network reachability to Node-RED, by firewall rule or by taking it off the proxy [S1].
• Enable adminAuth on every instance [S1].
• Before changing anything, export the flows file and capture memory or files from /dev/shm and /tmp. Restarting or redeploying destroys in-memory and /dev/shm evidence, and that cannot be undone [S2].
• Block outbound wget/curl from Node-RED hosts to unknown destinations [S2].
• Isolate any host that shows bot execution or webshell flows.

Eradicate

• Delete the malicious flows: the auto-triggered downloader flow, and the HTTP-in endpoints (e.g. /cmd) wired to exec nodes [S1][S2].
• Remove the bot binaries at /dev/shm/.b and /tmp/.kworker, and kill their processes [S2].
• Root cause: an unauthenticated Node-RED HTTP interface. Apply the Siemens patch on IoT2050 and enforce adminAuth elsewhere [S1][S2].
• Rotate credentials stored in Node-RED flows and credential files on affected hosts.

Recover

• Before restoring, confirm adminAuth is on, external reachability is gone, and the flows match a known-good baseline [S1].
• Rebuild hosts that ran the bot, rather than cleaning them in place.
• Afterwards, alert on any flow deploy, on Node-RED child processes, and on executables in /dev/shm or /tmp.

Re-enter the loop when

• Published IoCs appear for the attacker IP, download server or bot hashes.
• Exploitation is reported from sources other than the single AS8075 IP [S1].
• Confirmed victim compromises are reported beyond honeypots [S2].
• Node-RED or Siemens issues or changes an advisory, affected versions or fix.
• Node-RED is found running anywhere outside the expected OT/IoT scope.

Debrief

• Record every Node-RED instance found, its exposure, its adminAuth state, and when it was remediated.
• Record whether any flow deploys, /cmd-style requests or drop-path executables were found.
• Gap: there is no VulnCheck, Siemens or Node-RED primary source in the input.
• Gap: the attacker IP, download server, bot family and hashes are not given.
• Gap: the sources disagree on scope (generic Node-RED vs. IoT2050-only), and affected Node-RED versions are not stated.

Detection coverage — checked automatically

Checked automatically 2026-11-03 18:13Z from public sources: 3 published, 24 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-58115

http.title:"Node-RED"

http.html:"Node-RED"

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (Node-RED HTTP, Siemens SIMATIC IoT2050 Advanced) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"Node-RED HTTP", http.component:"Node-RED HTTP", product:"Siemens SIMATIC IoT2050 Advanced", http.component:"Siemens SIMATIC IoT2050 Advanced", host.services: (software.product = "Node-RED HTTP"), host.services: (software.product = "Siemens SIMATIC IoT2050 Advanced").

Banner spellings: a model read 6 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-03 18:13Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Is CVE-2026-58115 a Node-RED core flaw, or specific to Siemens IoT2050 packaging? S1 and S2 differ.
• Which Node-RED versions are affected, and is there an upstream fix?
• Is the 4.3.4.1 fixed version confirmed by a Siemens advisory?
• What are the attacker IP, the download server and the bot hashes?
• Has any compromise been confirmed outside honeypots?

Sources

• [S1] https://www.securityweek.com/critical-node-red-flaw-exploited-in-attacks/ · SecurityWeek
• [S2] https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.