Node-RED, a flow-based programming tool widely used in industrial control systems, is currently being targeted by unknown criminals exploiting a maximum-severity vulnerability to deploy malicious Linux bots, according to a recent report by The Register.
The vulnerability, identified as CVE-2026-58115, carries a perfect 10-out-of-10 CVSS rating. It stems from a lack of authentication on the Node-RED HTTP interface within affected Siemens devices, such as the SIMATIC IoT2050. This flaw allows unauthenticated remote attackers to execute system commands by creating malicious flows. Researchers at VulnCheck observed attackers weaponizing built-in inject and exec nodes to run shell commands immediately upon deployment. Between October 30 and November 1, 2026, researchers documented 16 attempts to exploit this specific vulnerability.
The activity appears to be part of opportunistic mass scanning, as the same infrastructure targeted eight different vulnerabilities across various products. The observed malware, labeled bot-linux-amd64, suggests a scan-and-infect strategy where compromised instances are directed to download payloads from separate servers. Experts advise organizations to restrict network access to Node-RED instances, apply available updates, and implement robust detection mechanisms to mitigate risks to operational technology environments, as these attacks increasingly threaten physical systems.
Source: The Register
