(TLP:CLEAR) Vulnerability Notification – Node-RED Actively Exploited

ACTION MAY BE REQUIRED for utilities using Node-RED, particularly instances reachable from the internet without administrative authentication (adminAuth) enabled, including Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.

Summary: Threat actors are actively exploiting Node-RED instances that lack authentication, according to recent reporting from VulnCheck. The activity targets a critical missing authentication vulnerability affecting Node-RED on Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 (CVSS 10.0). The vulnerability stems from a lack of authentication on the Node-RED HTTP interface. Successful exploitation could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

Node-RED is a low-code programming tool used across many industries, including utilities, and is embedded in commercial ICS/OT products. While WaterISAC is not aware of how widely the affected Siemens device is deployed within the water and wastewater sector, Node-RED itself may be embedded in other vendor products or deployed separately, and the observed exploitation technique targets any exposed Node-RED instance lacking authentication.

VulnCheck reported observing successful exploitation beginning October 30. By November 1, it had recorded 16 attacks from the same source. VulnCheck also assesses that threat actors are actively scanning for vulnerable Node-RED instances and exploiting them automatically. Additionally, VulnCheck noted that Emerson documentation references Node-RED, although it has not validated whether Emerson products are affected. A compromised Node-RED instance could provide attackers with a foothold inside trusted network environments, potentially enabling lateral movement, persistent access, or access to systems that support OT environments.

Siemens has released a fix for the IoT2050 Advanced, and version 4.3.4.1 and later contain the patch.

WaterISAC strongly encourages members to determine whether Node-RED is deployed anywhere within their environment, including embedded in ICS/OT devices, and to address the vulnerability according to Siemens’ recommendations in its advisory, including:

• Update SIMATIC IoT2050 Advanced devices to version 4.3.4.1 or later.
• Uninstall Node-RED where it is not needed.
• Harden Node-RED installations following the Node-RED User Guide, including enabling administrative authentication (adminAuth).

Additional Reading

• Siemens SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 Advanced with Industrial OS
• Exploitation Targeting Node-RED, a Tool Embedded in ICS Products
• Critical Node-RED Flaw Exploited in Attacks

WaterISAC PIRs: 6, 8