Critical Node-RED Vulnerability Exploited to Deploy Linux Malware
Unauthenticated access in industrial control systems allows attackers to execute remote shell commands.
1Critical Vulnerability Identified
Siemens assigned CVE-2026-58115 to a maximum-severity vulnerability in Node-RED, a flow-based programming tool. This bug carries a perfect 10-out-of-10 CVSS rating due to its severe impact on industrial control systems. The flaw stems from a lack of authentication on the Node-RED HTTP interface, enabling unauthenticated remote attackers to execute arbitrary system commands.
2Trivial Weaponization Mechanism
Researchers at VulnCheck identified that the vulnerability is trivial to weaponize using built-in Node-RED components. By connecting an inject node, which triggers messages on a schedule, to an exec node capable of running shell commands, attackers achieve immediate execution upon deployment. This requires no further interaction once the malicious flow is successfully uploaded.
3Active Exploitation Observed
On October 30, 2026, VulnCheck researchers detected an attacker exploiting this vulnerability against their canary network. The malicious activity originated from a single IP address, 4.201.105.116, geolocated to Brazil. The attacker sent the complete exploit, including the flow and dropper, in a single POST request to the target's Node-RED HTTP interface.
4Linux Malware Deployment
The exploit delivers a payload identified as bot-linux-amd64, indicating the malware specifically targets Linux systems running on AMD64 processors. While researchers did not retrieve the binary for full analysis, the filename suggests the operator may possess multiple builds. This malware represents a significant risk to internet-exposed OT and ICS devices globally.
5Opportunistic Mass Scanning
Between October 30 and November 1, the observed IP address targeted the Node-RED vulnerability 16 times. The attackers also logged 125 hits against eight different CVEs across the wider canary network, including a seven-year-old Apache Solr flaw. This pattern strongly suggests opportunistic mass scanning rather than a highly targeted, sophisticated state-sponsored cyberattack.
6Scan-and-Infect Infrastructure
The attack infrastructure appears to utilize a scan-and-infect arrangement. The host that identifies and exploits vulnerable instances pulls the actual implant from a separate, dedicated server, such as 85.215.73.250. This separation of duties allows attackers to scale their operations efficiently while maintaining a degree of separation between their scanning and payload delivery.
7Broader Industrial Security Risks
These exploits occur as criminals increasingly target internet-exposed OT and ICS devices, potentially causing physical harm. Recent incidents include refrigeration controller hacks across Europe and attacks on water systems across 12 US states. These events highlight the growing danger of bridging digital vulnerabilities to physical infrastructure through insecure automation tools like Node-RED.
8Mitigation and Defense Strategies
Organizations running Node-RED, particularly within OT environments, must verify if the interface is reachable from outside their network. Administrators should apply available updates immediately and implement robust detection mechanisms to reduce exploitation risks. Although the bug is in the VulnCheck KEV catalog, it has not yet appeared in the official US CISA KEV.