Changed since version 1

• Added the payload server 45.194.90[.]57:38472 and the payload name .sys_update to What happened, Verify and Contain [S1].
• Added the webshell detail: HTTP-in endpoints wired through a function node to an exec node, with /cmd or random paths [S1].
• Added 85.215.73.250 and wget.sh from the pipeline IoCs. Their roles are unconfirmed [S1].
• Added that SecurityWeek reports VulnCheck called the exploitation successful, which the honeypot-only framing qualifies [S1].
• Added NVD as S3 and the 2026-08-11 publish date to the timeline [S3].
• Added Eradicate actions and IoC-based Re-enter triggers.

What happened

• VulnCheck has observed exploitation of CVE-2026-58115 since Oct 30, 2026. It is a CVSS 10 missing-authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced [S1][S2].
• One HTTP request deploys and auto-triggers a flow. The flow runs a shell wrapper that uses wget, or curl as a fallback, to fetch a payload named .sys_update from 45.194.90[.]57:38472 [S1].
• The bot is saved as /dev/shm/.b or /tmp/.kworker and executed. The .kworker name imitates a kernel worker thread [S1][S2].
• Other requests plant webshells: an HTTP-in endpoint (/cmd or a random path) wired through a function node to an exec node that runs query-parameter commands [S1].
• The observations come from honeypots. SecurityWeek reports that VulnCheck called the exploitation successful, and no victim compromises are reported [S1][S2].

Timeline

Detect

Node-RED spawning shell or downloader · Linux host process events (EDR, auditd or Sysmon for Linux)

index=* (parent_process_name="node" OR parent_process_name="node-red" OR parent_process="*node-red*") process_name IN ("sh","bash","wget","curl") | stats count min(_time) as first max(_time) as last values(process) as cmdlines by host parent_process_name process_name

FROM logs-* | WHERE (process.parent.name IN ("node", "node-red") OR process.parent.command_line LIKE "*node-red*") AND process.name IN ("sh", "bash", "wget", "curl") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmdlines = VALUES(process.command_line) BY host.name, process.parent.name, process.name

A hit means: A Node-RED process launched a shell or a downloader, as the malicious flow does [S1][S2]. Treat it as likely compromise unless a known flow uses exec.

Flow deployment via admin API · Node-RED HTTP access logs / reverse proxy or web logs

index=* (uri_path="/flows" OR uri="*/flows*") (http_method="POST" OR method="POST") | stats count min(_time) as first max(_time) as last values(src_ip) as src by host uri_path status

FROM logs-* | WHERE (url.path == "/flows" OR url.original LIKE "*/flows*") AND http.request.method == "POST" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), src = VALUES(source.ip) BY host.name, url.path, http.response.status_code

A hit means: Flows were deployed through the admin API. A deploy from an external or unknown source matches the exploit [S1][S2]. Check it against change records.

Execution from /dev/shm/.b or /tmp/.kworker · Linux host process and file events

index=* (process="/dev/shm/.b*" OR process="/tmp/.kworker*" OR process_path="/dev/shm/*" OR file_path="/dev/shm/.b" OR file_path="/tmp/.kworker") | stats count min(_time) as first values(process) as cmdlines values(parent_process_name) as parents by host

FROM logs-* | WHERE process.command_line LIKE "/dev/shm/.b*" OR process.command_line LIKE "/tmp/.kworker*" OR process.executable LIKE "/dev/shm/*" OR file.path IN ("/dev/shm/.b", "/tmp/.kworker") | STATS count = COUNT(*), first = MIN(@timestamp), cmdlines = VALUES(process.command_line), parents = VALUES(process.parent.name) BY host.name

A hit means: A file was written to, or run from, a reported bot drop path [S1][S2]. Treat it as probable bot installation.

Requests to HTTP-in command endpoints · Node-RED HTTP access logs / reverse proxy or web logs

index=* (uri_path="/cmd" OR uri="*/cmd?*") | stats count min(_time) as first max(_time) as last values(src_ip) as src values(http_method) as methods by host uri_path status

FROM logs-* | WHERE url.path == "/cmd" OR url.original LIKE "*/cmd?*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), src = VALUES(source.ip), methods = VALUES(http.request.method) BY host.name, url.path, http.response.status_code

A hit means: Something requested a /cmd-style endpoint, which may be a webshell wired to an exec node [S1]. Paths can be random, so a miss is not clearance.

Verify

• Export the deployed flows. Look for HTTP-in nodes that feed function and exec nodes, and that no owner can explain [S1].
• Check egress and proxy logs for connections to 45.194.90[.]57 (port 38472) or 85.215.73[.]250. The second IP is listed in the pipeline IoCs; its role is not stated in the summaries [S1].
• Look for the files .sys_update and wget.sh and the hidden files /dev/shm/.b and /tmp/.kworker. Hash them and preserve them [S1][S2].
• Benign look-alike: legitimate automation flows that use exec nodes or wget/curl.
• Benign look-alike: authorised flow deploys from the editor.
• Benign look-alike: real kworker kernel threads. These have no file in /tmp.

Scope

Affected

• Siemens SIMATIC IoT2050 Advanced devices with Node-RED, in versions before 4.3.4.1 per pipeline exposure data [S2]
• Node-RED HTTP interfaces reachable without adminAuth [S1]

Only if

• Node-RED is installed and its editor/admin API has no adminAuth [S1]
• The interface is reachable from the internet or an untrusted network [S1]

Not affected if

• adminAuth is enabled [S1]
• Node-RED is not reachable from outside the network [S1]

Fixed in: SIMATIC IoT2050 Advanced 4.3.4.1, per pipeline exposure data. This is not stated in S1-S3; confirm it against the Siemens advisory.

Enumerate

• All Node-RED instances, including IoT2050 and building/OT gateways.
• Which instances are reachable from external or untrusted networks.
• The adminAuth state of each instance.
• The IoT2050 firmware versions.
• Flows containing exec nodes or HTTP-in endpoints.
• Egress to 45.194.90.57 and 85.215.73.250.

Contain

• Before changing anything, export the flows and capture /dev/shm, /tmp and memory. A reboot or redeploy destroys /dev/shm and in-memory evidence, and that cannot be undone [S1].
• Remove external and untrusted reachability to Node-RED [S1].
• Enable adminAuth on every instance [S1].
• Block egress to 45.194.90.57 and 85.215.73.250, and restrict outbound wget/curl from Node-RED hosts [S1].
• Isolate hosts that show bot execution or webshell flows.

Eradicate

• Delete malicious flows, including HTTP-in to function to exec chains [S1].
• Remove /dev/shm/.b, /tmp/.kworker, .sys_update and wget.sh [S1][S2].
• Update IoT2050 to 4.3.4.1 or later (confirm with Siemens).

Recover

• Before restoring, confirm adminAuth is on, external exposure is gone, and the flows match a known-good baseline [S1].
• Rebuild hosts that ran the bot.
• Afterwards, monitor flow deploys, Node-RED child processes, and egress to the listed IPs.

Re-enter the loop when

• VulnCheck, Siemens or Node-RED publishes an advisory with new IoCs or a new version range.
• Exploitation is reported against generic, non-IoT2050 Node-RED deployments.
• Confirmed victim compromises are reported.
• The CVE is added to CISA KEV.
• Any hunt hit appears on an internal asset.

Debrief

• Record each instance with its exposure, adminAuth state, version and remediation date.
• Record any flow deploys, webshell requests, IoC egress or drop-path files found.
• Gap: there is no primary VulnCheck, Siemens or Node-RED source in the input.
• Gap: the bot family and hashes are unknown, and the role of 85.215.73.250 is unstated.
• Gap: whether generic Node-RED is affected beyond IoT2050 is unclear.

Detection coverage — checked automatically

Checked automatically 2026-11-10 11:17Z from public sources: 4 published, 23 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-58115 — Attackers exploit Siemens SIMATIC IoT2050 Node-RED flaw (CVE-2026-58115) to plant command backdoors. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-58115

http.title:"Node-RED"

http.html:"Node-RED Flow Editor"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (Siemens SIMATIC IoT2050 Advanced, Node-RED) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"Siemens SIMATIC IoT2050 Advanced", http.component:"Siemens SIMATIC IoT2050 Advanced", product:"Node-RED", http.component:"Node-RED", host.services: (software.product = "Siemens SIMATIC IoT2050 Advanced"), host.services: (software.product = "Node-RED").

Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 11:17Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Is 4.3.4.1 the Siemens-stated fix, and which Node-RED versions are affected?
• Does the flaw affect Node-RED outside IoT2050, or only the IoT2050 packaging?
• What role does 85.215.73.250 play?
• Is there a public PoC repo? The context mentions one, but no source names it.

Sources

• [S1] https://www.securityweek.com/critical-node-red-flaw-exploited-in-attacks/ · SecurityWeek
• [S2] https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html · The Hacker News
• [S3] https://nvd.nist.gov/vuln/detail/cve-2026-58115 · nvd.nist.gov

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.