{"type":"bundle","id":"bundle--b7e8132e-cf53-5841-9dec-b78ee2c8d4b9","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--a696469f-efad-5466-944a-74e9219e879a","created":"2026-11-03T18:12:52.227Z","modified":"2026-11-03T18:12:52.227Z","name":"Node-RED editors with no login are being hijacked to run a Linux bot and webshells (CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced)","description":"CVE-2026-58115 (CVSS v3.1 10.0 and CVSS v4.0 10.0, CWE-306) was published by Siemens ProductCERT on 2026-08-11 in SSA-834709 and republished by CISA as ICSA-26-237-03 on 2026-08-25. SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices before V4.3.4.1 running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated remote attacker can create flows with nodes that execute system commands, with maximum privileges. The root cause is the Node-RED default: the editor and admin API are unsecured unless adminAuth is configured, so any Node-RED instance reachable without adminAuth accepts the same request. VulnCheck reported in-the-wild exploitation caught by a canary on 2026-10-30: a single POST /flows deploying an inject node wired to an exec node that downloads bot-linux-amd64 to /dev/shm/.b and runs it, followed by 16 events from the same AS8075 source through 2026-11-01 including a staged script, a second payload server, and http-in webshell flows. VulnCheck added the CVE to its own KEV; it is not on CISA KEV as of catalog 2026.10.30.","aliases":["CVE-2026-58115","SSA-834709","ICSA-26-237-03","Node-RED adminAuth missing","Node-RED unauthenticated POST /flows","Siemens IoT2050 Node-RED missing authentication"],"first_seen":"2026-08-11T00:00:00.000Z","last_seen":"2026-11-01T00:00:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Siemens ProductCERT SSA-834709","url":"https://cert-portal.siemens.com/productcert/html/ssa-834709.html"},{"source_name":"CISA ICSA-26-237-03 Siemens SIMATIC IoT2050 Advanced","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03"},{"source_name":"VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products","url":"https://www.vulncheck.com/blog/exploitation-targeting-node-red"},{"source_name":"Node-RED: Securing Node-RED","url":"https://nodered.org/docs/user-guide/runtime/securing-node-red"},{"source_name":"Node-RED Admin API: POST /flows","url":"https://nodered.org/docs/api/admin/methods/post/flows/"},{"source_name":"Node-RED Admin API: GET /auth/login","url":"https://nodered.org/docs/api/admin/methods/get/auth/login/"},{"source_name":"CVE-2026-58115 CVE record","url":"https://www.cve.org/CVERecord?id=CVE-2026-58115"},{"source_name":"HOL: Node-RED editors with no login exploited (CVE-2026-58115), fix and check","url":"https://hol.org/blog/cve-2026-58115-node-red-no-login-exploited-siemens-iot2050"}]}]}