Hackers Are Exploiting a Perfect 10 Node-RED Flaw on Siemens Industrial Gateways to Drop Linux Bots

A bug with a perfect severity score in the automation software that runs inside industrial gateways is now being used in the wild. On October 30, a VulnCheck honeypot caught an attacker exploiting it to drop what looks like a Linux bot, and the exploit took a single request.

The flaw sits in Node-RED, a flow-based programming tool built on Node.js. It is widely used for workflow automation in industrial control systems and operational technology, including inside commercial products such as the Siemens SIMATIC IoT2050.

No login required

Siemens assigned the bug CVE-2026-58115 in August and rated it 10 out of 10. Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface. Anyone who can reach it gets unauthenticated access to programming nodes that can run system commands, and can create malicious flows remotely.

VulnCheck researcher Patrick Garrity said two built-in nodes make the flaw "trivial to weaponize." The inject node fires a message on a schedule or once at startup. The exec node runs shell commands. "Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction," he wrote.

The attacker did exactly that. "It didn't just scan us," Garrity said. "It sent the complete exploit, flow and dropper, in a single POST /flows."

A bot of unknown purpose

The traffic came from one IP address in Microsoft's AS8075 network that geolocates to Brazil. The payload was named bot-linux-amd64, which points to a Linux bot built for AMD64 machines and possibly other builds too. What it does is still unknown. "We did not fetch the binary, so we can't say what it does once running," Garrity said.

Between October 30 and November 1, that same address hit the Node-RED bug 16 times and logged 125 hits against eight different CVEs across VulnCheck's canary network. The list included a seven-year-old Apache Solr flaw, CVE-2019-17558, along with targets such as Camunda, Gitea, MLflow, Traefik and Joomla.

One of those hits pulled its payload from a separate server, suggesting a scan-and-infect setup in which exploiting hosts fetch the implant from dedicated infrastructure. Garrity called it "opportunistic mass scanning rather than a targeted attack." Nobody picked out a specific plant. Any exposed box will do.

Industrial gear keeps getting hit

That fits a pattern. Criminals are increasingly going after internet-exposed OT and industrial devices, from attacks on water systems in at least 12 US states over the summer to the refrigeration hacks spreading across Europe, where attackers recently forced supermarket freezers in Belgium and Sweden to 50 C.

Garrity's advice is to check today whether Node-RED can be reached from outside the network, apply updates where they are available and add detections. VulnCheck has put the bug in its Known Exploited Vulnerabilities catalog. As of the report, it had not yet appeared in CISA's.

Some offers on this page may be paid placements or contain affiliate links.