Cyber attackers have begun to leverage a serious vulnerability within Node-RED, a widely used low-code programming tool, according to VulnCheck, a company specializing in vulnerability intelligence. This tool facilitates the development of event-driven applications and finds application in numerous sectors, particularly within commercial Industrial Control Systems (ICS) and Operational Technology (OT) devices.
Understanding the Node-RED Flaw
Identified as CVE-2026-58115, this vulnerability has been assigned a critical severity score of 10 out of 10 on the CVSS scale. The flaw arises from a lack of authentication measures on the Node-RED HTTP interface, potentially allowing unauthorized users to access programming nodes capable of executing system-level commands.
Siemens, a prominent user of Node-RED in their SIMATIC IoT2050 Advanced devices, disclosed the flaw on August 11. The company has since released security patches beginning with version 4.3.4.1 of its Industrial OS to address the vulnerability.
Exploitation of the Vulnerability
On October 30, VulnCheck reported observing active exploitation of this vulnerability. The attack originated from an IP address within Microsoft’s AS8075 network and involved deploying a Node-RED flow that automatically triggered the download of a binary from a server controlled by the attackers. This process was obscured by three layers of encoding, complicating detection efforts.
The payload deployed was identified as a Linux bot, and the execution command bypassed checks for successful installation. VulnCheck suggests the attackers have prepared payloads compatible with multiple system architectures, as inferred from the file naming conventions used.
Ongoing Threat and Mitigation
By November 1, VulnCheck had identified 15 more attacks from the same IP address, delivering additional malicious payloads, including persistent webshells. These allow attackers to execute arbitrary commands on compromised servers, indicating a sophisticated effort to exploit Node-RED instances without admin authentication settings.
VulnCheck advises all Node-RED users to assess their systems’ exposure to external networks and to scrutinize any unexpected flows or HTTP endpoints within their deployed applications. This is particularly crucial for environments where Node-RED is integrated with ICS/OT systems.
In light of these developments, it is imperative for organizations leveraging Node-RED to apply the recommended security patches promptly and to continuously monitor their systems for any signs of unauthorized access or unexpected activities.
