The IoT2050 Node-RED has no login. The canary got the bot. This is not a PLC write.

VulnCheck 2 November. CVE-2026-58115, CVSS 10, SIMATIC IoT2050 Advanced. Unauthenticated Node-RED HTTP. First canary hit 30 October. Linux bot to /dev/shm/.b, then a /cmd that survives reboot. Not CISA KEV. Not a process write.

RWP Ventures · 2026-11-03 · event 2026-10-30 · 12 min read · priority 8.8

Do not collapse five facts.

1. This is a gateway Linux box, not a PLC write. IoT2050 Advanced is a SIMATIC IPC-class IoT gateway (MLFB 6ES7647-0BA00-1YA2). CISA lists sectors Chemical, Critical Manufacturing, Energy, Transportation. A rooted Node-RED on that box is CONFIRMED capable of arbitrary code as the Node-RED process. It is not evidence of a ladder-logic change, a historian wipe, or FrostyGoop. Do not upgrade a canary bot into process impact.
2. The CVE is August. The wild use is this weekend. SSA-834709 V1.0 is 11 August 2026. Last update is still that date. CISA republished it as ICSA-26-237-03 on 25 August. [15 August Weekly OT](/posts/2026-08-15-weekly-ot-ics-patch-winnipeg/) already named the missing-auth RCE as an advisory. The overnight increment is canary-confirmed exploitation, not a new ProductCERT.
3. Unauthenticated. One HTTP request. Network, no user. Affected: Industrial OS < V4.3.4.1 with Node-RED installed. The Node-RED HTTP interface does not enforce authentication, so a remote attacker who can reach it can deploy flows that run system commands. Siemens CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and 4.0 10.0. CWE-306. Close: V4.3.4.1 or later, or uninstall / harden Node-RED.
4. Opportunistic scan-and-infect, not a named ICS crew. Same source IP also hit Apache Solr CVE-2019-17558, Camunda, Gitea, MLflow, Traefik, and Joomla — 125 canary events across eight CVEs. VulnCheck: that breadth is mass scanning, not a targeted plant intrusion. Binary not retrieved. No victim organization. No ransomware flag.
5. Not CISA KEV. Not today’s due-date tickets. Live catalog this morning: 2026.10.30 / 1766, dateReleased 2026-10-30T17:02:45Z. No 58115 row. [CVE-2026-110936](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/) (Siemens Software Center) and [Plex CVE-2026-96652 / 96655](/posts/2026-10-21-plex2shell-kev-assume-compromise/) are due today. Those are clocks on already-published KEVs. Different assets. Yesterday’s [CyberStrikeAI](/posts/2026-11-02-cyberstrikeai-llm-post-exploitation/) is an education AD implant, not this gateway.

The operator sentence: if you have SIMATIC IoT2050 Advanced with Node-RED, get it off any network you do not fully trust until it is V4.3.4.1 or Node-RED is gone. Hunt unexpected exec nodes and HTTP-in endpoints. A 200 on POST /flows from the internet is the incident, not a curiosity.

What happened

Siemens assigned CVE-2026-58115 to IoT2050 Advanced running Industrial OS with Node-RED. The product description in SSA-834709 is the compact SIMATIC IOT gateway at the bottom of the IPC range. The bug is not “Node-RED is insecure in the abstract.” It is that this Siemens image ships a Node-RED HTTP interface without authentication, and Node-RED’s programming nodes can run OS commands.

VulnCheck researcher Patrick Garrity (2 November, analysis 30 October, update 1 November): one canary received a complete exploit in a single POST /flows. The canary answered HTTP 200 with a new flow revision hash — the signature VulnCheck records as a successful exploit. Detection for this CVE shipped 27 October; the first wild attempt was three days later. VulnCheck moved the CVE into its KEV catalog. It is not in CISA’s.

Observed payload classes, high level, not a reproduction:

VulnCheck did not retrieve bot-linux-amd64, wget.sh, or .kworker. Capabilities of those binaries are UNKNOWN. Do not call them ransomware, a miner, or ICS malware.

Why it matters

Three operational reasons this is the daily.

First: the programming tool is the remote shell. Node-RED is how some plants wire sensors, MQTT, and HTTP at the edge. On this image, the editor API is the attack surface. Defenders who inventory “PLCs and HMIs” and skip the IoT gateway with a browser IDE will miss the box that is actually answering POST /flows from the internet.

Second: August CVSS 10 with no KEV still gets a bot in 2026. ProductCERT published in August. CISA republished in August. The catalog did not move. Overnight, a scanner treated the Node-RED admin API like every other unauthenticated flow deployer in its kit. That is the PHP2Shell lesson on a Siemens MLFB: the public SSA is not the close. Internet reachability is.

Third: the rest of today’s queue is clocks. Plex SSRF rows and Software Center ClickFix are due for FCEB under BOD 26-04 today. They were already this desk’s dailies. Repeating them because the due date is 3 November is not a material development. A CVSS 10 OT gateway with new canary exploitation is.

This is not confirmed OT process impact. A gateway that also talks to a PLC is still a Linux incident until someone shows a process write.

Who / what is affected

Confirmed (Siemens / CISA, August):

• SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions < V4.3.4.1, running Industrial OS with Node-RED installed.
• Unauthenticated remote code execution via the Node-RED HTTP interface.
• Vendor fix V4.3.4.1 or later. Mitigations: uninstall Node-RED, or harden it (HTTPS, editor and admin API authentication, basic auth on HTTP nodes and the dashboard) per the Node-RED user guide.

Confirmed (VulnCheck, 2 November):

• In-the-wild exploit traffic against canaries from 30 October through 1 November.
• Source 4.201.105.116 (Microsoft AS8075, geolocation Brazil). Treat as likely rented or compromised cloud, not an operator identity.
• Payload hosts 85.215.73.250:8080 and 45.194.90.57:38472.
• Opportunistic: same source hit seven unrelated products.

Confirmed not this:

• CISA KEV listing. Catalog 2026.10.30 / 1766.
• Siemens ProductCERT update. SSA-834709 is still V1.0 / 11 August.
• A named victim plant, a nation-state, or ransomware use.
• IoT2050 Basic (different MLFB, 6ES7647-0BA00-0YA2) as an affected row in SSA-834709. Do not assume the Basic image without Node-RED on Industrial OS is the same CVE.
• [CVE-2026-110936](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/) Siemens Software Center ClickFix. Engineering PC, local load path, already on KEV.
• Copy Fail CVE-2026-31431 on IoT2050 Advanced (local kernel, prior weekly). Different bug.

UNKNOWN / not validated:

• Whether Emerson or other OEMs that document Node-RED inherit this exact CVE. VulnCheck notes Emerson docs; it did not validate impact. Do not invent a second affected product.
• Internet-facing population of IoT2050 Advanced. No Shadowserver or CISA count in the sources used here.
• What the dropped binaries do.
• Generic Node-RED (Raspberry Pi, Docker, cloud) is the same class of misconfiguration when adminAuth is off. The assigned CVE is Siemens’s for this image. Do not mint CVEs for other vendors.

Technical context

High level. This is not a how-to.

Node-RED stores automation as JSON flows. Two built-in node types are enough for a dropper: an inject node that fires once after deploy, and an exec node that runs a shell command. VulnCheck’s first event wrapped the real dropper in layered encoding so a naive filter looking for wget in the raw body would miss it. The dropper tried wget then curl, wrote a hidden file on tmpfs (/dev/shm/.b), and detached with setsid / nohup. Later events skipped the binary and left an HTTP-in endpoint that executes a query parameter — a webshell that lives in the flow database across reboot.

Prerequisite: network path to the Node-RED HTTP interface. No credentials in the SSA. No user interaction.

Hunt seeds from VulnCheck (not a closed set):

ATT&CK mapping (assessed from VulnCheck’s observed steps, not a CISA assignment): T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1105 Ingress Tool Transfer; T1036.005 Match Legitimate Name or Location (.kworker); T1505.003 Web Shell; T1027 Obfuscated Files or Information (encoded dropper in the flow).

Threat / exploitation status

What defenders should do

1. Inventory the MLFB, the OS, and whether Node-RED is installed. IoT2050 Advanced 6ES7647-0BA00-1YA2, Industrial OS < 4.3.4.1, Node-RED present. If Node-RED is not installed, this CVE’s prerequisite is not met — still confirm the interface is not reachable. Firmware: Siemens entry 109741799.
2. Pull it off untrusted networks before you argue the change window. CISA’s standing ICS advice applies: do not put control-system devices on the internet. If the Node-RED port answers from a plant DMZ, a vendor VPN, or a cellular tail, treat that as exposure. Patch to V4.3.4.1+, or uninstall Node-RED, or put adminAuth / HTTPS / HTTP-node basic auth in place and restrict source IPs.
3. Hunt the flow database, not just the binary. Unexpected exec nodes. HTTP-in paths you did not design (/cmd, random). A 200 to POST /flows from an address that is not your engineering station. Files /dev/shm/.b, /tmp/.s, /tmp/.kworker. Egress to 85.215.73.250:8080 and 45.194.90.57:38472. A killed tmpfs file is not a clean box if the flow still has an HTTP-in exec.
4. If Node-RED was reachable and unauthenticated, assume the Linux userspace is hostile. Rotate credentials and keys that lived on the gateway (MQTT, historian, VPN, API tokens). Rebuild from known-good firmware. Do not “just delete the flow.”
5. Keep today’s KEV clocks on separate tickets. Software Center CVE-2026-110936 due 3 November is an engineering-PC ClickFix. Plex CVE-2026-96652 / 96655 due 3 November is a media server. Ivanti CVE-2026-111357 was due yesterday. None of those are this hunt.
6. If you run Node-RED anywhere else, check adminAuth today. Same class of attack, different CVE. Do not wait for Siemens to assign your Docker image a number.

RWP assessment

This is the daily because it is the first public, dated exploitation evidence against a CVSS 10 Siemens OT gateway CVE that this desk already flagged as an advisory in August. Evidence quality is high on the vulnerability and the canary chain (ProductCERT + CISA ICSA + VulnCheck telemetry). Evidence quality is low on victims, binary function, and process consequence. We are not calling a targeted ICS campaign, not inventing Emerson impact, not folding this into Software Center 110936, and not treating a rooted gateway as a confirmed physical-process incident.

Score 8.8. It outranks repeating today’s Software Center and Plex due dates (already published; no catalog increment), yesterday’s CyberStrikeAI (different asset, already shipped), Sophos GOLD OGRE / Aur0ra agentic ransomware (Help Net Security 2 November; Sophos primary 29–30 October, overlapping the AI-orchestration theme already covered), WorkOS’s ARTEX-assisted CRM incident (production identity plane not reported hit), BTCPay / CryptoPayment Gateway wallet thefts (wrong desk), WSO2 API Manager CVE-2026-4052 (critical, no exploitation), and Unit 42’s Qilin/INC expansion on Palo Alto CVE-2026-0257 (KEV since May; campaign expansion, not overnight OT).

What we are watching

• Whether CISA adds CVE-2026-58115 to KEV, or Siemens revises SSA-834709 past V1.0.
• Whether a national CERT, Dragos, Claroty, or Nozomi names a real IoT2050 victim — still UNKNOWN.
• Whether the dropped binaries are retrieved and what they actually are.
• Whether other Node-RED-embedded ICS products get a CVE or a “not affected.”
• Catalog increment past 2026.10.30 / 1766.
• FCEB clocks that hit today: Software Center 110936, Plex 96652 / 96655. Brotli CVE-2026-111497 and Adobe Commerce CVE-2026-48356 due 10 November.

Sources

• VulnCheck — Exploitation Targeting Node-RED, a Tool Embedded in ICS Products, 2 November 2026
• Siemens ProductCERT — SSA-834709 V1.0, 11 August 2026
• CISA — ICSA-26-237-03 Siemens SIMATIC IoT2050 Advanced
• CVE — CVE-2026-58115
• NVD — CVE-2026-58115
• The Hacker News — Attackers Exploit Critical Siemens IoT2050 Flaw, 3 November 2026
• Node-RED — Securing Node-RED
• Siemens Industry Support — IoT2050 firmware 109741799
• CISA — KEV JSON feed
• CISA — Known Exploited Vulnerabilities Catalog
• [RWP — Siemens Software Center CVE-2026-110936, 20 October 2026](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/)
• [RWP — Plex2Shell KEV, 21 October 2026](/posts/2026-10-21-plex2shell-kev-assume-compromise/)
• [RWP — CyberStrikeAI, 2 November 2026](/posts/2026-11-02-cyberstrikeai-llm-post-exploitation/)