Critical Node-RED Vulnerability Exploited to Deploy Linux Malware
Unauthenticated attackers are weaponizing a perfect CVSS-rated flaw to compromise industrial control systems.
1Critical Vulnerability Identified
A maximum-severity vulnerability, tracked as CVE-2026-58115, affects the Node-RED flow-based programming tool. With a perfect 10-out-of-10 CVSS rating, this flaw allows unauthenticated remote attackers to execute system commands. Siemens assigned the identifier to address risks in devices like the SIMATIC IoT2050, which rely on this tool for critical industrial workflow automation.
2Trivial Weaponization Mechanism
Researchers at VulnCheck confirmed the vulnerability is trivial to weaponize using built-in Node-RED components. By wiring an inject node to an exec node, attackers can trigger shell commands immediately upon deployment. This simple configuration requires no further interaction, enabling malicious actors to execute arbitrary code on exposed devices without any authentication barriers.
3Active Exploitation Observed
On October 30, 2026, VulnCheck’s canary network detected an attacker exploiting the flaw. The activity originated from a single IP address, 4.201.105.116, geolocated to Brazil within Microsoft’s AS8075 network. The attacker sent a complete exploit, including the flow and a dropper, in a single POST request to the target's HTTP interface.
4Targeting Linux Systems
The identified malware payload, named bot-linux-amd64, specifically targets Linux environments running on AMD64 processors. While researchers did not retrieve the full binary for analysis, the filename suggests the operator maintains multiple builds. This indicates a sophisticated, albeit opportunistic, approach to compromising internet-exposed operational technology and industrial control systems across global networks.
5Opportunistic Mass Scanning
Between October 30 and November 1, the same IP address targeted the Node-RED vulnerability 16 times. The attacker also logged 125 hits against eight different CVEs, including a seven-year-old Apache Solr flaw. This pattern suggests opportunistic mass scanning rather than a highly targeted attack against specific critical infrastructure entities or industrial organizations.
6Scan-and-Infect Infrastructure
The attack architecture appears to utilize a scan-and-infect arrangement. The host performing the exploit is distinct from the server hosting the malware payload, identified as 85.215.73.250. By separating the scanning and infection delivery mechanisms, the attackers likely aim to increase the efficiency of their campaign while complicating efforts to trace the primary command infrastructure.
7Broader Industrial Risks
This incident highlights the growing trend of criminals targeting internet-exposed OT and ICS devices. Recent examples include refrigeration controller hacks in Europe and attacks on water systems across 12 US states. These breaches demonstrate how cyberattacks on industrial tools can produce real-life physical harm, necessitating urgent security reviews for all connected hardware.
8Immediate Mitigation Steps
Organizations running Node-RED, especially within OT environments, must verify if instances are reachable from outside their networks. Administrators should apply available updates immediately and implement robust detection mechanisms to monitor for unauthorized flow deployments. While the bug is in VulnCheck’s KEV catalog, proactive internal patching remains the primary defense against ongoing exploitation.