Node-RED auth bypass in Siemens IoT2050 exploited in the wild

Attackers have started exploiting a critical Node-RED authentication bypass, according to VulnCheck, which reported the activity to SecurityWeek on November 3.

The bug is a missing authentication check on the Node-RED HTTP interface. Siemens disclosed it on August 11 after finding it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens' advisory says affected devices don't enforce authentication on that interface, so an unauthenticated remote attacker can reach programming nodes that run system commands and create malicious flows, executing code on the server with maximum privileges. Siemens rates it 10 in both CVSS 3.1 and 4.0. Version 4.3.4.1 and later carry the fix.

VulnCheck says it saw successful exploitation on October 30, from an IP in AS8075, Microsoft's network. The request deployed a Node-RED flow, triggered it, and pulled a binary from an attacker-controlled server behind three layers of encoding. The payload was a Linux bot, and VulnCheck thinks the attackers had builds for several architectures.

By November 1 it had logged 15 more attacks from the same address, some dropping persistent webshells.

VulnCheck's advice is blunt: if Node-RED runs anywhere, including inside ICS/OT kit, check today whether it's reachable from outside your network, and look through deployed flows for exec nodes or HTTP endpoints you didn't put there. The webshells matter more than the bot here, since they survive a reboot and give a shell back.

What nobody has published is how many hosts are exposed or how many were hit. The advisory doesn't say either.

CVE references

CVE-2026-58115