Observed activity

The attacker tried to make the flow run itself

VulnCheck reports that one of its canaries received a complete exploit on 30 October for CVE-2026-58115. The request installed a Node-RED flow that would download and execute a Linux binary. VulnCheck later saw 16 events from the same source address with several payloads. The researchers did not retrieve the bot binary, so its capabilities remain unknown.

The canary response showed that the exploit request worked against the instrumented target. That is evidence of exploitation activity, not proof that the same actor compromised a particular customer installation. The source address being in Microsoft's network does not establish Microsoft involvement.

Affected product

An old Siemens fix has become a current priority

Siemens lists SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed and versions before 4.3.4.1 as affected. The Node-RED HTTP interface lacks authentication in that configuration, allowing a remote attacker to create a malicious flow and execute commands with high privileges. Siemens released 4.3.4.1 in its August advisory.

Keep the scope exact

This Siemens advisory covers the specified IoT2050 Advanced configuration. Node-RED also runs elsewhere, but the published Siemens affected-product list should not be extended to other vendors without their own confirmation.

Defender workflow

Find the editor before the attacker does

  1. 1

    Inventory Node-RED instances. Include embedded devices, engineering environments and separately installed Node-RED services. Record whether the admin interface is reachable from untrusted networks.

  2. 2

    Update affected Siemens systems. Move affected IoT2050 Advanced devices to Industrial OS 4.3.4.1 or later. Where that cannot happen promptly, follow Siemens' guidance to remove or harden Node-RED and restrict access.

  3. 3

    Look for unexpected flows. Review deployed flows, changes to the admin interface, command-execution nodes and outbound downloads. Preserve evidence before removing suspicious flows.

Defender note

A management interface is an execution surface

Node-RED is useful because a flow can connect inputs to actions. On an exposed, unauthenticated editor, that same design can turn one HTTP request into command execution. Treat access to the editor like access to an administrative console, especially on devices that bridge IT and operational networks.