A CVSS 10.0 Siemens Bug Is Being Exploited Through Node-RED. The Request Hides wget and curl in Base64, and the Bug Is Not on CISA's List.
If you run a Siemens SIMATIC IoT2050 Advanced with Node-RED installed, upgrade Industrial OS to 4.3.4.1 or later, or uninstall Node-RED, and check the box for the files listed below. A bug in that product is under active exploitation, and one request is enough to run commands as root.
VulnCheck published the exploitation details on November 2. The flaw is CVE-2026-58115, rated CVSS 10.0. Siemens described it in an advisory in August 2026 as missing authentication in the Node-RED HTTP interface: an unauthenticated remote attacker can create a flow and run code on the device with maximum privileges. As of October 30, VulnCheck said it saw attackers trying to weaponize it against its honeypot network to download and run a Linux bot.
One request is the whole exploit
VulnCheck's canary received a single POST to the flows path from curl 8.5.0. The body was a Node-RED flow of three nodes: an empty tab, an inject node set to fire once after one second, and an exec node wired to it. Node-RED runs a flow as soon as it is deployed, so nothing else was needed.
The exec node's command pipes a base64 string through base64 -d into sh. That matters for defenders. A filter that looks for wget or curl in the request body will not see either word, because both are inside the encoded string. VulnCheck decoded it and found a dropper that downloads a file named bot-linux-amd64 from 85.215.73.250 on port 8080 into /dev/shm/.b, falls back to curl if wget is missing, marks it executable and starts it detached.
VulnCheck documents two more variants. In one, the attackers moved to two stages, where the first command fetches a shell script named wget.sh from the same server and runs it. In another, the request fetched a file from a second server, 45.194.90.57 on port 38472, and saved it as /tmp/.kworker, a name that mimics a kernel worker thread. VulnCheck's write-up does not give us a clean order for these, so we do not claim one.
Some requests deployed no downloader at all. The flow exposed an HTTP in endpoint, for example /cmd or a randomly named path, wired through a function node to an exec node with the payload option enabled, so the attacker could send commands later in a query parameter. VulnCheck notes that this backdoor survives even if a memory-backed implant is lost on reboot.
VulnCheck did not retrieve or analyze the bot binary and says it makes no claims about its capabilities. Neither do we.
What to check on a device you own
These come straight from VulnCheck's request and dropper. A file or flow matching any of them on an IoT2050 means treat the device as compromised.
- A file at /dev/shm/.b, or a process running from it.
- A file at /tmp/.kworker, or /tmp/.s. A real kernel worker thread has no path in /tmp.
- Outbound HTTP to 85.215.73.250 on port 8080 or 45.194.90.57 on port 38472.
- A Node-RED flow with an inject node set to run once, wired to an exec node whose command contains base64 -d piped to sh.
- A flow with an HTTP in endpoint wired to an exec node, especially one with an odd or random path.
- Any POST to the flows path from an address you do not recognize. The one VulnCheck saw used the user agent curl/8.5.0.
Upgrading is the first step. Our reading, which Siemens and VulnCheck do not state, is that a patch fixes the missing authentication and does not necessarily remove a flow an attacker already deployed, so look for one after upgrading. Siemens' mitigation if you cannot upgrade is to uninstall Node-RED, or to put basic authentication on the HTTP nodes and the Node-RED dashboard.
It is not on CISA's list
CISA's Known Exploited Vulnerabilities catalog, version 2026.10.30, which we pulled today, does not contain CVE-2026-58115. VulnCheck's own evidence is a honeypot and not a victim report, so this is the usual lag between a vendor seeing exploitation and the catalog reflecting it, and the catalog may change before you read this. If your patch process is driven by KEV deadlines, this one has none yet.
This also reaches past one Siemens model. VulnCheck notes that Node-RED is embedded in commercial ICS and OT products, and mentions Emerson's documentation of its use, but says it has not validated whether any other product is affected by this CVE. We make no claim about any product other than the one Siemens named.
What we hold, and what we don't
We hold two indicators from VulnCheck's report, the payload servers 85.215.73.250 and 45.194.90.57, ingested today from the vendor's report as a third-party source and not as our own detection. We did not ingest the 64-character string in VulnCheck's write-up. It is the revision ID that a Node-RED instance returns after a flow is deployed, not a file hash, and blocking it would mean nothing.
We have no sighting of our own. We checked our edge for Node-RED flow deployments and for either server since August 1 and found none. Our edge counted 51 blocked requests with "flow" in the path, and all were probes for Flowise or Langflow, which are different products. Our canaries cover paths we trapped, and none is a Node-RED path, so a zero there is a coverage fact and not evidence that nobody is scanning. We are citing VulnCheck. We did not see this first.
Limits
This rests on VulnCheck's November 2 report, on The Hacker News coverage of it, and on Siemens' advisory as quoted in both. We did not read the Siemens advisory directly or test any device. VulnCheck's observations come from one honeypot network, so the number of real devices exposed or compromised is unknown to us. The IP addresses are infrastructure that someone else saw, and servers like these rotate. Treat them as a starting point for hunting, not a complete list.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.