Node-RED is the plumbing of a lot of industrial automation: a flow-based, Node.js programming environment that engineers use to wire sensors, PLCs and dashboards together. On Siemens' SIMATIC IoT2050 Advanced gateway it is also listening on an HTTP interface that can be told to execute shell commands — and, in the deployment VulnCheck found, it asks for no password.

That is CVE-2026-58115, CVSS 10.0, missing authentication for a critical function. Siemens published an advisory in August 2026 and fixed it in Industrial OS 4.3.4.1; its own text is unusually direct, describing flows that let an unauthenticated remote attacker "execute arbitrary code on the underlying server with maximum privileges."

On 30 October, VulnCheck's honeypots recorded the first exploitation attempt. "The attacker's request was a complete exploit," researcher Patrick Garrity wrote. "It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding."

The chain is built entirely from product features, which is why it needs no memory-corruption exploit and no public proof-of-concept. A single POST to the flows endpoint installs an inject node wired to an exec node; the inject fires one second later; the exec node runs a base64 wrapper that decodes a shell command and pipes it to the shell. That downloads an AMD64 bot binary with wget, falling back to curl, to /dev/shm/.b — a tmpfs path that leaves no trace on disk — and launches it with setsid and nohup so it survives the Node-RED worker.

Follow-up requests moved to a two-stage downloader (wget.sh) and to a payload named .kworker placed in /tmp, disguised as a kernel worker thread. Other flows skipped the downloader entirely: an HTTP-in endpoint (for example /cmd) wired through a function node to an exec node with addpay enabled gives the attacker a webshell that survives a reboot even if the memory-backed implant does not.

Known infrastructure in the reports: 85.215.73.250 and 45.194.90.57:38472. None of the secondary payloads could be retrieved, so their function is unknown.

Mitigation is boring and urgent: patch to Industrial OS 4.3.4.1, or uninstall Node-RED if it is not needed; set adminAuth in settings.js for standalone installs; never expose port 1880 to the internet; put management interfaces behind a VPN or an authenticating proxy; and audit deployed flows for exec nodes and undocumented HTTP-in endpoints. Researchers count more than 20,000 Node-RED management interfaces reachable from the public internet. An automation tool without a password is not an automation tool; it is a remote shell with a nice editor.

Sources