# CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware

> CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw (CWE-306) in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices that lets an unauthenticated remote attacker deploy malicious flows and execute system commands with maximum privileges. VulnCheck observed in-the-wild exploitation from Oct 30 to Nov 1, 2026 delivering a Linux AMD64 payload named bot-linux-amd64, assessed as opportunistic mass scanning.

- **Published:** 2026-11-02T23:26:13Z
- **Last reviewed:** 2026-11-03T05:49:26.912Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5105
- **ID:** TL-2026-5105
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)
- **CVEs:** CVE-2026-58115, CVE-2019-17558

## Description

CVE-2026-58115 affects the Node-RED installation on the Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, in all versions before V4.3.4.1. The Node-RED HTTP interface does not enforce authentication, so an unauthenticated remote attacker can reach programming nodes capable of executing system commands and create malicious flows, resulting in arbitrary code execution on the underlying server with maximum privileges. Siemens published advisory SSA-834709 (V1.0) on 2026-08-11; the CVE scores 10.0 under both CVSS v3.1 (scope changed, AV:N/AC:L/PR:N/UI:N) and CVSS v4.0. The weakness is CWE-306 (Missing Authentication for Critical Function). The advisory lists no acknowledgments, and at publication no active exploitation was reported.

Exploitation is trivial because of two built-in Node-RED nodes. The inject node fires a message on a schedule or once at startup, and the exec node runs shell commands. Per The Register, wiring one to the other yields a flow that executes a command as soon as it is deployed, with no further interaction. VulnCheck's researcher Patrick Garrity is quoted: the attacker 'didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows.'

On 2026-11-02 VulnCheck and The Register reported in-the-wild exploitation. A VulnCheck canary detected the first exploitation on 2026-10-30; a single source IP attacked this vulnerability 16 times between Oct 30 and Nov 1, 2026 and logged 125 hits against eight CVEs across the canary network. The observed payload is a Linux AMD64 binary named bot-linux-amd64, fetched from 85.215.73.250, with attack traffic from 4.201.105.116 (Microsoft AS8075 address space, geolocated to Brazil). VulnCheck characterizes the activity as opportunistic mass scanning rather than a targeted attack; no actor attribution has been stated and no malware family has been named. The same campaign traffic also targeted CVE-2019-17558, a seven-year-old Apache Solr flaw affecting products such as Camunda, Gitea, MLflow, Traefik and Joomla. The flaw was added to VulnCheck KEV but was not yet in CISA KEV at the time of reporting. Note: The Register describes the issue as affecting Node-RED on Siemens devices 'and other devices'; only the IoT2050 Advanced is named in the Siemens advisory.

Defenders should treat any Node-RED editor/admin HTTP interface reachable without authentication as compromised-until-proven-otherwise: review deployed flows for inject-to-exec chains, inspect for the bot-linux-amd64 file and outbound connections to the listed hosts, monitor for anomalous child-process execution from the Node-RED runtime, and update affected devices to V4.3.4.1 or later.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1608.001 Upload Malware
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1505.003 Server Software Component
- T1027.010 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Masquerading
- T1564.001 Hide Artifacts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-58115 Node-RED Unauthenticated Flow Deployment (inject-to-exec POST /flows)** (`TL-2026-5105-SPL-001`)

Detects the single-request exploit for CVE-2026-58115 (Siemens SIMATIC IoT2050 Node-RED, CWE-306): an HTTP POST to /flows whose body deploys an inject node wired to an exec node, or carries the bot-linux-amd64 dropper, or originates from the observed attacker IP 4.201.105.116. VulnCheck saw the complete exploit, flow and dropper arrive in one POST /flows.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1059.004, T1059.007
- **Data sources:** stream:http, access_combined, CommonSecurityLog, web_access_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=web (sourcetype="stream:http" OR sourcetype="access_combined") earliest=-24h@h
| eval m=coalesce(http_method, method), p=coalesce(uri_path, uri), body=lower(coalesce(form_data, http_request_body, request_body, ""))
| where m="POST" AND match(p, "^/flows?(\\?.*)?$")
```comment: Node-RED admin API deploy. exec+inject nodes or dropper strings in the body are the high-fidelity CVE-2026-58115 signal```
| eval exec_node=if(match(body, "type\\W{1,4}exec\\W"),1,0), inject_node=if(match(body, "type\\W{1,4}inject\\W"),1,0), func_node=if(match(body, "child_process|type\\W{1,4}function\\W.{0,400}(exec|spawn)"),1,0), dropper=if(match(body, "bot-linux-amd64|85\\.215\\.73\\.250|(curl|wget)\\W.{0,200}(chmod|/tmp/|/dev/shm/)"),1,0), ioc_src=if(src_ip="4.201.105.116",1,0)
| where exec_node=1 OR func_node=1 OR dropper=1 OR ioc_src=1
| stats count as deploy_requests, min(_time) as first_seen, max(_time) as last_seen, values(dest) as targets, values(dest_port) as dest_ports, max(exec_node) as exec_node, max(inject_node) as inject_node, max(func_node) as func_node, max(dropper) as dropper by src_ip
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
````

### Microsoft KQL

```kql
let ioc_src = dynamic(["4.201.105.116","85.215.73.250"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL matches regex @"(^|://[^/]+)/flows?(\?|$)"
| extend Body = tolower(strcat(RequestContext, " ", AdditionalExtensions))
| extend ExecNode = Body matches regex @"type\W{1,4}exec\W", InjectNode = Body matches regex @"type\W{1,4}inject\W", Dropper = Body matches regex @"bot-linux-amd64|85\.215\.73\.250|(curl|wget)\W.{0,200}(chmod|/tmp/|/dev/shm/)", FuncNode = Body matches regex @"child_process|type\W{1,4}function\W.{0,400}(exec|spawn)"
| where ExecNode or FuncNode or Dropper or SourceIP in (ioc_src) or DestinationPort == 1880
| summarize Requests=count(), ExecHits=countif(ExecNode), InjectHits=countif(InjectNode), FuncHits=countif(FuncNode), DropperHits=countif(Dropper), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Targets=make_set(DestinationIP, 20) by SourceIP, DeviceVendor
```

### Sigma

```yaml
title: Node-RED Unauthenticated Flow Deployment via POST /flows (CVE-2026-58115)
id: 3f6b8c1e-5a2d-4e7b-9c41-2d8a7e1b0f11
status: experimental
description: Detects HTTP POST requests to the Node-RED /flows admin endpoint, the single-request deployment path abused for CVE-2026-58115 on Siemens SIMATIC IoT2050, or any request from the observed exploitation source IP
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-834709.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58115
    - https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1190
    - attack.t1059
    - cve.2026.58115
logsource:
    category: webserver
detection:
    selection_deploy:
        cs-method: 'POST'
        cs-uri-stem|endswith: '/flows'
    selection_ioc:
        c-ip:
            - '4.201.105.116'
            - '85.215.73.250'
    condition: selection_deploy or selection_ioc
falsepositives:
    - Legitimate Node-RED administrators deploying flows from the editor
    - CI/CD pipelines that push flows through the admin API
level: high

```

**Known false positives:**

- Legitimate Node-RED administrators deploying flows from the editor over HTTP
- Automation or CI/CD tooling that pushes flows through the admin API

**Tuning notes:** Allowlist known engineering workstation and jump-host source IPs for POST /flows. If request bodies are not captured, drop the body conditions and alert on any POST /flows returning HTTP 200/204 from a non-admin source. Node-RED with adminAuth returns 401 to unauthenticated deploys, so a 200/204 is the strongest signal. Add the Node-RED port if not 1880.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Opportunistic Scanning Burst: [indicator] POST /flows and Solr CVE-2019-17558 Probes from One Source (locked: unlock with TL Creds)
- [indicator] Dropper Execution and Staging Commands from [indicator] (CVE-2026-58115) (locked: unlock with TL Creds)
- Download or Reverse-Shell Tooling Spawned by [indicator] Reaching External Hosts (CVE-2026-58115) (locked: unlock with TL Creds)
- [indicator] Flow Deployment Request Returning Success to Unauthenticated Client (CVE-2026-58115) (locked: unlock with TL Creds)
- [indicator] Payload File Written to Disk (CVE-2026-58115) (locked: unlock with TL Creds)
- Linux Host Network Connection to CVE-2026-58115 Payload and Attacker IPs (Sysmon for Linux) (locked: unlock with TL Creds)
- CVE-2026-58115 Shell Child Process Spawned by [indicator] Runtime (exec node) (locked: unlock with TL Creds)
- CVE-2026-58115 Traffic To or From Exploitation and Payload Infrastructure ([indicator], [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `4.201.105[.]116`
- File hash: `4662660a5924cc8f09736d32ca1b8d8728d8e69805e7d1e8c9efdbdffa3cf0f1`
- IP address: `85.215.73[.]250`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Max-severity bug in widely used OT programming tool exploited to deliver Linux malware (The Register)](https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086)
- [Siemens Security Advisory SSA-834709](https://cert-portal.siemens.com/productcert/html/ssa-834709.html)
- [Siemens SSA-834709 CSAF](https://cert-portal.siemens.com/productcert/csaf/ssa-834709.json)
- [CVE-2026-58115 CVE Program record (cvelistV5)](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58115.json)
- [NVD - CVE-2026-58115](https://nvd.nist.gov/vuln/detail/CVE-2026-58115)
- [SIMATIC IoT2050 Node-RED Auth Bypass (V4.3.4.0) Arbitrary System Exec - stack.watch](https://stack.watch/vuln/CVE-2026-58115/)
- [SSA-834709 - CIRCL Vulnerability Lookup](https://cve.circl.lu/vuln/ssa-834709)
- [Siemens SIMATIC IoT2050 firmware download (fix V4.3.4.1)](https://support.industry.siemens.com/cs/ww/en/view/109741799/)
- [NCSC-NL CSAF record for CVE-2026-58115](https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58115.json)
- [CraftedSignal brief: August 2026 Siemens security updates (CVE-2026-58115)](https://feed.craftedsignal.io/briefs/2026-08-siemens-security-updates/)
- [CVE-2026-58115 - Lutra Security Fieldguide](https://fieldguide.lutrasecurity.com/CVE-2026-58115/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5105