Threats tagged 'node-red'

Exploitation activity targeting CVE-2026-58115, an unauthenticated Node-RED admin API vulnerability, was detected on October 30, 2026. Attackers used Node-RED's inject and exec nodes to execute commands without authentication, deploying malicious flows that download and execute Linux bots. The payloads included staged shell scripts and persistent webshells, with binaries saved in RAM-backed storage to evade disk forensics. This vulnerability affects Node-RED embedded in critical infrastructure products such as Siemens SIMATIC IoT2050 devices, posing a risk to industrial control systems environments. The exploitation appears opportunistic and involves mass scanning across multiple CVEs rather than targeted attacks.