{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-B0E825AE",
  "slug": "cve-2026-58115-node-red-no-login-exploited-siemens-iot2050",
  "title": "Node-RED editors with no login are being hijacked to run a Linux bot and webshells (CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced)",
  "aliases": [
    "CVE-2026-58115",
    "SSA-834709",
    "ICSA-26-237-03",
    "Node-RED adminAuth missing",
    "Node-RED unauthenticated POST /flows",
    "Siemens IoT2050 Node-RED missing authentication"
  ],
  "summary": "CVE-2026-58115 (CVSS v3.1 10.0 and CVSS v4.0 10.0, CWE-306) was published by Siemens ProductCERT on 2026-08-11 in SSA-834709 and republished by CISA as ICSA-26-237-03 on 2026-08-25. SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices before V4.3.4.1 running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated remote attacker can create flows with nodes that execute system commands, with maximum privileges. The root cause is the Node-RED default: the editor and admin API are unsecured unless adminAuth is configured, so any Node-RED instance reachable without adminAuth accepts the same request. VulnCheck reported in-the-wild exploitation caught by a canary on 2026-10-30: a single POST /flows deploying an inject node wired to an exec node that downloads bot-linux-amd64 to /dev/shm/.b and runs it, followed by 16 events from the same AS8075 source through 2026-11-01 including a staged script, a second payload server, and http-in webshell flows. VulnCheck added the CVE to its own KEV; it is not on CISA KEV as of catalog 2026.10.30.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "VulnCheck's events come from one source IP and VulnCheck did not retrieve the bot binary or staged scripts, so their function is unknown. Siemens does not describe what changes in Industrial OS V4.3.4.1. Exposure counts of internet-reachable Node-RED instances without adminAuth are not published in the primary sources. The observation that the published POST /flows body replaces the existing flow set is HOL's reading of the Node-RED admin API documentation (full deployment by default, rev omitted forces deploy), not a statement from VulnCheck.",
  "firstObservedAt": "2026-08-11T00:00:00.000Z",
  "lastObservedAt": "2026-11-01T00:00:00.000Z",
  "publishedAt": "2026-11-03T18:12:52.227Z",
  "reviewedAt": "2026-11-03T18:12:40.462Z",
  "expiresAt": "2026-11-01T00:00:00.000Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "siemens-ssa",
      "label": "Siemens ProductCERT SSA-834709",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-834709.html",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-08-11T00:00:00Z"
    },
    {
      "id": "cisa-icsa",
      "label": "CISA ICSA-26-237-03 Siemens SIMATIC IoT2050 Advanced",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03",
      "sourceType": "government",
      "observedAt": "2026-08-25T00:00:00Z"
    },
    {
      "id": "vulncheck",
      "label": "VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products",
      "url": "https://www.vulncheck.com/blog/exploitation-targeting-node-red",
      "sourceType": "research",
      "observedAt": "2026-11-02T00:00:00Z"
    },
    {
      "id": "nodered-security",
      "label": "Node-RED: Securing Node-RED",
      "url": "https://nodered.org/docs/user-guide/runtime/securing-node-red",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-11-01T00:00:00.000Z"
    },
    {
      "id": "nodered-post-flows",
      "label": "Node-RED Admin API: POST /flows",
      "url": "https://nodered.org/docs/api/admin/methods/post/flows/",
      "sourceType": "other_primary",
      "observedAt": "2026-11-01T00:00:00.000Z"
    },
    {
      "id": "nodered-auth-login",
      "label": "Node-RED Admin API: GET /auth/login",
      "url": "https://nodered.org/docs/api/admin/methods/get/auth/login/",
      "sourceType": "other_primary",
      "observedAt": "2026-11-01T00:00:00.000Z"
    },
    {
      "id": "cve-record",
      "label": "CVE-2026-58115 CVE record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58115",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-08-11T12:20:24Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Node-RED editors with no login exploited (CVE-2026-58115), fix and check",
      "url": "https://hol.org/blog/cve-2026-58115-node-red-no-login-exploited-siemens-iot2050",
      "sourceType": "other_primary",
      "observedAt": "2026-11-03T18:03:28Z"
    }
  ],
  "artifacts": [
    {
      "id": "simatic-iot2050-advanced",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) with Node-RED installed",
      "version": "< V4.3.4.1 (Industrial OS)",
      "defanged": false
    },
    {
      "id": "node-red-no-adminauth",
      "artifactClass": "config",
      "ecosystem": "npm",
      "name": "Node-RED settings.js without adminAuth (default)",
      "version": null,
      "defanged": false
    }
  ],
  "indicators": [
    {
      "id": "bot-url",
      "indicatorType": "url",
      "value": "hxxp://85.215.73[.]250:8080/bot-linux-amd64",
      "defanged": true,
      "confidence": "medium"
    },
    {
      "id": "wgetsh-url",
      "indicatorType": "url",
      "value": "hxxp://85.215.73[.]250:8080/wget.sh",
      "defanged": true,
      "confidence": "medium"
    },
    {
      "id": "sysupdate-url",
      "indicatorType": "url",
      "value": "hxxp://45.194.90[.]57:38472/.sys_update",
      "defanged": true,
      "confidence": "medium"
    }
  ],
  "timeline": [
    {
      "id": "siemens-advisory",
      "occurredAt": "2026-08-11T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "Siemens ProductCERT publishes SSA-834709 for CVE-2026-58115 (CVSS 10.0, CWE-306) with fix V4.3.4.1 and mitigations uninstall or harden Node-RED.",
      "sourceIds": [
        "siemens-ssa"
      ]
    },
    {
      "id": "cisa-republication",
      "occurredAt": "2026-08-25T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "CISA republishes the Siemens advisory as ICSA-26-237-03.",
      "sourceIds": [
        "cisa-icsa"
      ]
    },
    {
      "id": "vulncheck-detection",
      "occurredAt": "2026-10-27T00:00:00.000Z",
      "eventType": "other",
      "summary": "VulnCheck publishes detection artifacts for CVE-2026-58115 for its Initial Access customers.",
      "sourceIds": [
        "vulncheck"
      ]
    },
    {
      "id": "itw-first",
      "occurredAt": "2026-10-30T00:00:00.000Z",
      "eventType": "first_observed",
      "summary": "VulnCheck canary records a successful exploit: single POST /flows deploying inject plus exec nodes that download and run bot-linux-amd64.",
      "sourceIds": [
        "vulncheck"
      ]
    },
    {
      "id": "itw-update",
      "occurredAt": "2026-11-01T00:00:00.000Z",
      "eventType": "other",
      "summary": "VulnCheck reports 16 events from the same source IP, additional droppers and http-in webshell flows; CVE added to VulnCheck KEV, not CISA KEV.",
      "sourceIds": [
        "vulncheck"
      ]
    },
    {
      "id": "hol-blog",
      "occurredAt": "2026-11-03T18:03:28.791Z",
      "eventType": "other",
      "summary": "HOL Guard publishes an operator write-up with the /auth/login check, adminAuth and uiHost hardening, the flows review command and scope notes.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-node-red",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not sit in front of Node-RED or ICS gateways; the fix is the Siemens update or Node-RED adminAuth plus network restriction."
    }
  ],
  "policies": [],
  "limitations": [
    "SIMATIC IoT2050 Advanced devices without Node-RED installed are outside the Siemens advisory.",
    "Node-RED instances with adminAuth configured and no write-capable default user reject unauthenticated POST /flows (flows.write required).",
    "Instances bound to 127.0.0.1 are not reachable by network scanners, though local processes can still reach them.",
    "Only the IoT2050 Advanced article number 6ES7647-0BA00-1YA2 is listed by Siemens; other products embedding Node-RED are not assessed in the advisory.",
    "Excluding the exec node via nodesExcludes is defence in depth only; without adminAuth the admin API can still install palette modules through POST /nodes unless externalModules.palette.allowInstall is false."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-58115-node-red-no-login-exploited-siemens-iot2050/corrections"
}