Skip to navigation

Threat reportVulnerabilityTL-2026-5105

CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware

criticalACTIVE

CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw (CWE-306) in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices that lets an unauthenticated remote attacker deploy malicious flows and execute system commands with maximum privileges. VulnCheck observed in-the-wild exploitation from Oct 30 to Nov 1, 2026 delivering a Linux AMD64 payload named bot-linux-amd64, assessed as opportunistic mass scanning. First disclosed .

Key facts for SIMATIC IoT2050 Node-RED flaw

IdentifiersTL-2026-5105, CVE-2026-58115, CVE-2019-17558
Also known asSSA-834709
SeverityCRITICAL
CVSS10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
First disclosed
Exploitation statusExploited in the wild
Affected productsSiemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) with Industrial OS and Node-RED
Weaknesses (CWE)CWE-306
MalwareZeroAccess, bot-linux-amd64
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1059.004 Unix Shell, T1190 Exploit Public-Facing Application, T1595.002 Vulnerability Scanning, T1608.001 Upload Malware
MotivationUNKNOWN
Target sectorsmanufacturing, energy, critical infrastructure, industrial automation, technology
Target regionsGlobal
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage for SIMATIC IoT2050 Node-RED flaw

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5105 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-58115 Node-RED Unauthenticated Flow Deployment (inject-to-exec POST /flows)

Detects the single-request exploit for CVE-2026-58115 (Siemens SIMATIC IoT2050 Node-RED, CWE-306): an HTTP POST to /flows whose body deploys an inject node wired to an exec node, or carries the bot-linux-amd64 dropper, or originates from the observed attacker IP 4.201.105.116. VulnCheck saw the complete exploit, flow and dropper arrive in one POST /flows.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059, T1059.004, T1059.007
  • Data sources: stream:http, access_combined, CommonSecurityLog, web_access_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web (sourcetype="stream:http" OR sourcetype="access_combined") earliest=-24h@h
| eval m=coalesce(http_method, method), p=coalesce(uri_path, uri), body=lower(coalesce(form_data, http_request_body, request_body, ""))
| where m="POST" AND match(p, "^/flows?(\\?.*)?$")
```comment: Node-RED admin API deploy. exec+inject nodes or dropper strings in the body are the high-fidelity CVE-2026-58115 signal```
| eval exec_node=if(match(body, "type\\W{1,4}exec\\W"),1,0), inject_node=if(match(body, "type\\W{1,4}inject\\W"),1,0), func_node=if(match(body, "child_process|type\\W{1,4}function\\W.{0,400}(exec|spawn)"),1,0), dropper=if(match(body, "bot-linux-amd64|85\\.215\\.73\\.250|(curl|wget)\\W.{0,200}(chmod|/tmp/|/dev/shm/)"),1,0), ioc_src=if(src_ip="4.201.105.116",1,0)
| where exec_node=1 OR func_node=1 OR dropper=1 OR ioc_src=1
| stats count as deploy_requests, min(_time) as first_seen, max(_time) as last_seen, values(dest) as targets, values(dest_port) as dest_ports, max(exec_node) as exec_node, max(inject_node) as inject_node, max(func_node) as func_node, max(dropper) as dropper by src_ip
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")

Microsoft KQL

let ioc_src = dynamic(["4.201.105.116","85.215.73.250"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL matches regex @"(^|://[^/]+)/flows?(\?|$)"
| extend Body = tolower(strcat(RequestContext, " ", AdditionalExtensions))
| extend ExecNode = Body matches regex @"type\W{1,4}exec\W", InjectNode = Body matches regex @"type\W{1,4}inject\W", Dropper = Body matches regex @"bot-linux-amd64|85\.215\.73\.250|(curl|wget)\W.{0,200}(chmod|/tmp/|/dev/shm/)", FuncNode = Body matches regex @"child_process|type\W{1,4}function\W.{0,400}(exec|spawn)"
| where ExecNode or FuncNode or Dropper or SourceIP in (ioc_src) or DestinationPort == 1880
| summarize Requests=count(), ExecHits=countif(ExecNode), InjectHits=countif(InjectNode), FuncHits=countif(FuncNode), DropperHits=countif(Dropper), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Targets=make_set(DestinationIP, 20) by SourceIP, DeviceVendor

Sigma

title: Node-RED Unauthenticated Flow Deployment via POST /flows (CVE-2026-58115)
id: 3f6b8c1e-5a2d-4e7b-9c41-2d8a7e1b0f11
status: experimental
description: Detects HTTP POST requests to the Node-RED /flows admin endpoint, the single-request deployment path abused for CVE-2026-58115 on Siemens SIMATIC IoT2050, or any request from the observed exploitation source IP
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-834709.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58115
    - https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1190
    - attack.t1059
    - cve.2026.58115
logsource:
    category: webserver
detection:
    selection_deploy:
        cs-method: 'POST'
        cs-uri-stem|endswith: '/flows'
    selection_ioc:
        c-ip:
            - '4.201.105.116'
            - '85.215.73.250'
    condition: selection_deploy or selection_ioc
falsepositives:
    - Legitimate Node-RED administrators deploying flows from the editor
    - CI/CD pipelines that push flows through the admin API
level: high

Known false positives:

  • Legitimate Node-RED administrators deploying flows from the editor over HTTP
  • Automation or CI/CD tooling that pushes flows through the admin API

Tuning notes: Allowlist known engineering workstation and jump-host source IPs for POST /flows. If request bodies are not captured, drop the body conditions and alert on any POST /flows returning HTTP 200/204 from a non-admin source. Node-RED with adminAuth returns 401 to unauthenticated deploys, so a 200/204 is the strongest signal. Add the Node-RED port if not 1880.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Opportunistic Scanning Burst: [indicator] POST /flows and Solr CVE-2019-17558 Probes from One Source · unlock with TL Creds
  • [indicator] Dropper Execution and Staging Commands from [indicator] (CVE-2026-58115) · unlock with TL Creds
  • Download or Reverse-Shell Tooling Spawned by [indicator] Reaching External Hosts (CVE-2026-58115) · unlock with TL Creds
  • [indicator] Flow Deployment Request Returning Success to Unauthenticated Client (CVE-2026-58115) · unlock with TL Creds
  • [indicator] Payload File Written to Disk (CVE-2026-58115) · unlock with TL Creds
  • Linux Host Network Connection to CVE-2026-58115 Payload and Attacker IPs (Sysmon for Linux) · unlock with TL Creds
  • CVE-2026-58115 Shell Child Process Spawned by [indicator] Runtime (exec node) · unlock with TL Creds
  • CVE-2026-58115 Traffic To or From Exploitation and Payload Infrastructure ([indicator], [indicator]) · unlock with TL Creds

Indicators of compromise for SIMATIC IoT2050 Node-RED flaw

As of 2026-11-02, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5105.

Sample indicators (2 of 10)

  • IP address: 4.201.105[.]116
  • IP address: 85.215.73[.]250

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

10 indicators of compromise · unlock with TL Creds. Compare plans

How SIMATIC IoT2050 Node-RED flaw works

CVE-2026-58115 affects the Node-RED installation on the Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, in all versions before V4.3.4.1. The Node-RED HTTP interface does not enforce authentication, so an unauthenticated remote attacker can reach programming nodes capable of executing system commands and create malicious flows, resulting in arbitrary code execution on the underlying server with maximum privileges. Siemens published advisory SSA-834709 (V1.0) on 2026-08-11; the CVE scores 10.0 under both CVSS v3.1 (scope changed, AV:N/AC:L/PR:N/UI:N) and CVSS v4.0. The weakness is CWE-306 (Missing Authentication for Critical Function). The advisory lists no acknowledgments, and at publication no active exploitation was reported.

Exploitation is trivial because of two built-in Node-RED nodes. The inject node fires a message on a schedule or once at startup, and the exec node runs shell commands. Per The Register, wiring one to the other yields a flow that executes a command as soon as it is deployed, with no further interaction. VulnCheck's researcher Patrick Garrity is quoted: the attacker 'didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows.'

On 2026-11-02 VulnCheck and The Register reported in-the-wild exploitation. A VulnCheck canary detected the first exploitation on 2026-10-30; a single source IP attacked this vulnerability 16 times between Oct 30 and Nov 1, 2026 and logged 125 hits against eight CVEs across the canary network. The observed payload is a Linux AMD64 binary named bot-linux-amd64, fetched from 85.215.73.250, with attack traffic from 4.201.105.116 (Microsoft AS8075 address space, geolocated to Brazil). VulnCheck characterizes the activity as opportunistic mass scanning rather than a targeted attack; no actor attribution has been stated and no malware family has been named. The same campaign traffic also targeted CVE-2019-17558, a seven-year-old Apache Solr flaw affecting products such as Camunda, Gitea, MLflow, Traefik and Joomla. The flaw was added to VulnCheck KEV but was not yet in CISA KEV at the time of reporting. Note: The Register describes the issue as affecting Node-RED on Siemens devices 'and other devices'; only the IoT2050 Advanced is named in the Siemens advisory.

Defenders should treat any Node-RED editor/admin HTTP interface reachable without authentication as compromised-until-proven-otherwise: review deployed flows for inject-to-exec chains, inspect for the bot-linux-amd64 file and outbound connections to the listed hosts, monitor for anomalous child-process execution from the Node-RED runtime, and update affected devices to V4.3.4.1 or later.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Initial Access

T1190 Exploit Public-Facing Application

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1608.001 Upload Malware

Remediation for SIMATIC IoT2050 Node-RED flaw

Patches

  • Siemens SSA-834709: SIMATIC IoT2050 Advanced V4.3.4.1 or later

Immediate actions

  • Update SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) to V4.3.4.1 or later
  • Restrict network access to the Node-RED HTTP interface; do not expose it to the internet
  • Review deployed Node-RED flows for inject nodes wired to exec nodes and remove unrecognized flows
  • Hunt for the file bot-linux-amd64 and for connections to 85.215.73.250 and 4.201.105.116
  • Block 4.201.105.116 and 85.215.73.250 at the perimeter

Workarounds

  • Uninstall Node-RED if not required
  • Harden the Node-RED installation per the Node-RED security documentation
  • Restrict network access to affected devices with appropriate security controls

Longer-term hardening

  • Enable Node-RED adminAuth and follow the Node-RED security hardening guidance
  • Segment OT/IoT gateways from untrusted networks and apply Siemens operational security guidelines
  • Alert on POST requests to /flows from non-administrative sources
  • Alert on shell child processes spawned by the Node-RED runtime

Affected and fixed versions

  • Siemens — SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) with Industrial OS and Node-RED
    Vulnerable versions: all versions < V4.3.4.1
    Fixed in: V4.3.4.1 or later

Timeline of SIMATIC IoT2050 Node-RED flaw

  • CVE-2026-58115 reserved in the CVE Program.
  • locked-ioc-7 publishes SSA-834709 (V1.0) and the CVE record; fix released in SIMATIC IoT2050 Advanced V4.3.4.1 (CVSS 10.0, CWE-306). No active exploitation reported at release.
  • CVE record last modified; no confirmed exploitation reported at that time.
  • A locked-ioc-5 canary detects first in-the-wild exploitation of CVE-2026-58115 against locked-ioc-6.
  • Between Oct 30 and Nov 1, 2026 a single IP attacks this flaw 16 times and locked-ioc-5 logs 125 hits across eight CVEs (including CVE-2019-17558), delivering the locked-ioc-2 payload.
  • locked-ioc-5 (Patrick Garrity) and The Register report exploitation; flaw added to locked-ioc-5 KEV, not yet in CISA KEV.

Sources cited for SIMATIC IoT2050 Node-RED flaw

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats