Attackers are exploiting a maximum-severity flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced industrial gateways, according to security firm VulnCheck, SecurityWeek reported Tuesday. The case shows how fast months-old industrial advisories turn into live targets, and why plant and facilities owners cannot leave fixes that must be installed by hand waiting.
What Happened
Siemens disclosed the flaw, tracked as CVE-2026-58115, on Aug. 11 and rated it 10.0, the top score on the standard severity scale. Node-RED is an open-source, low-code tool for wiring devices and services together through a browser-based editor. On affected gateways running versions earlier than 4.3.4.1, that editor requires no login, so a remote attacker can create programs that run commands with full control of the device, Siemens said in its advisory. The company recommends updating to 4.3.4.1 or later, or removing or hardening Node-RED.
VulnCheck, in a warning issued Sunday, said its systems caught the first exploitation attempt Oct. 30 and logged 16 attacks from the same source through Nov. 1. The attacks installed a program that downloaded Linux malware, and later attempts left hidden web backdoors that accept commands. VulnCheck said it did not analyze the malware. The same address also tried to exploit seven other flaws in unrelated software, heise reported, and VulnCheck said attackers are scanning for Node-RED instances without login protection and exploiting them automatically.
The flaw was not in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of Tuesday.
Why It Matters
Node-RED is used in products across many sectors, including commercial industrial control equipment, SecurityWeek reported. The German tech outlet heise reported that administrators must install the Siemens firmware fix themselves. The risk to physical operations is the same one behind this week's supermarket refrigeration attacks: control equipment reachable from the internet with weak or no login.
Owners should update affected gateways, turn on Node-RED's built-in login protection, which the project's security guide says is off by default, and keep the editor off the internet. VulnCheck also advised reviewing deployed flows for unexpected command-running steps or web endpoints.
What to Watch
Watch whether CISA adds the flaw to its catalog or issues an industrial advisory, whether Siemens updates its notice, and whether other vendors' Node-RED-based products prove exposed.
