Search — “CVE-2026-58115”

Since Oct 30, 2026, VulnCheck has observed attackers exploiting CVE-2026-58115, a CVSS 10 missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices. A single HTTP request deploys and auto-triggers a malicious flow that runs a shell wrapper using wget (curl fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests plant persistent webshells: an HTTP in endpoint (e.g. /cmd) wired to an exec node that runs commands from a query parameter. SecurityWeek reports VulnCheck called the exploitation successful; hunt for wget/curl/sh spawned by the Node-RED process, hidden files in /dev/shm and /tmp, and unexpected exec nodes or HTTP endpoints in deployed flows.

VulnCheck observed attackers, from October 30, 2026, exploiting CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices, against its honeypots. The exploit deploys and auto-triggers a malicious Node-RED flow that runs a shell wrapper using wget (with curl as fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests create HTTP-in endpoints (e.g. /cmd) wired to exec nodes as a persistent command backdoor. Observations are from honeypots; no confirmed victim compromises are reported. Hunt for Node-RED spawning sh/wget/curl, new flows deployed via the admin API, and executables in /dev/shm or /tmp hidden files.

VulnCheck reports in-the-wild exploitation of CVE-2026-58115, a CVSS 10 missing-authentication bug in the Node-RED HTTP interface, first observed October 30 from a single IP in AS8075. The attacker deployed a Node-RED flow that was triggered automatically and pulled a Linux bot binary from an attacker-controlled server. By November 1, VulnCheck saw 15 more attacks from the same IP delivering persistent webshells. Hunters should look for Node-RED instances without adminAuth reachable from outside, and for unexpected exec nodes or HTTP endpoints in deployed flows.