Ethical Hacking News
A max-severity bug in a widely used OT programming tool has been exploited to deliver Linux malware, posing a significant threat to industrial IoT and operational technology (OT) environments. The bug, identified as CVE-2026-58115, has a perfect 10-out-of-10 CVSS rating, making it a max-severity bug. If you run Node-RED anywhere, including inside OT environments, you should check today whether it's reachable from outside your network, apply updates where available, and implement detections to reduce the risk of exploitation.
A recent security vulnerability in Node-RED has been exploited to deliver Linux malware, posing a significant threat to industrial IoT and OT environments. The bug, CVE-2026-58115, has a perfect 10-out-of-10 CVSS rating and allows unauthenticated access to programming nodes that can execute system commands on Siemens devices. The vulnerability is "trivial to weaponize" due to the presence of two Node-RED built-in nodes that make it easy to create malicious flows. The attackers are using opportunistic mass scanning rather than a targeted attack, targeting the same Node-RED vulnerability 16 times. OT environments should check for updates, apply patches, and implement detections to reduce the risk of exploitation. The incident highlights the need for greater collaboration and information sharing between OT environments, researchers, and vendors to stay ahead of emerging threats and vulnerabilities.
A recent security vulnerability in a widely used OT programming tool has been exploited by malicious actors to deliver Linux malware, posing a significant threat to industrial IoT and operational technology (OT) environments. The bug, identified as CVE-2026-58115, has a perfect 10-out-of-10 CVSS rating, making it a max-severity bug.
Node-RED, a flow-based programming tool, is commonly used for workflow automation in industrial control systems (ICS) and OT environments. It is built on top of Node.js and is used in commercial products, including Siemens SIMATIC IoT2050. The bug affects Siemens devices that do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands on the device.
According to VulnCheck researcher Patrick Garrity, the bug is "trivial to weaponize" due to the presence of two Node-RED built-in nodes that make it easy to create malicious flows. One node fires a message either on a schedule or once at startup, while the other node can run shell commands. By wire one to the other, the flow executes a command as soon as it is deployed, with no further interaction.
The activity observed by VulnCheck came from a single IP address, 4.201.105[.]116, which sits in Microsoft's AS8075 network and geolocates to Brazil. The researchers saw this IP address target the same Node-RED vulnerability 16 times between October 30 and November 1, and log 125 hits against eight different CVEs across their wider canary network. This suggests "opportunistic mass scanning rather than a targeted attack," according to Garrity.
The mix of old and new bugs across unrelated products indicates that the attackers are using opportunistic mass scanning rather than a targeted attack. The filename, bot-linux-amd64, indicates that the malware targets Linux running on AMD64 processors and suggests that the malware operator may have other builds.
While there's a lot that the researchers don't yet know about the attacks, they are warning that if you run Node-RED anywhere, including inside OT environments, you should check today whether it's reachable from outside your network, apply updates where available, and implement detections to reduce the risk of exploitation.
The bug has been added to VulnCheck's Known Exploited Vulnerabilities (KEV) catalog, but it hasn't appeared in the US Cybersecurity and Infrastructure Security Agency's KEV yet. This highlights the need for OT environments to stay vigilant and proactive in patching and securing their systems.
The incident highlights the increasing threat of cyberattacks on industrial IoT and OT environments, which can have real-life harm and impact the physical world. The ongoing refrigeration controller hacks across Europe and the attacks on water systems across at least 12 US states over the summer are just a few examples of the growing threat.
In light of this incident, it is essential for OT environments to take proactive measures to secure their systems and prevent similar attacks. This includes ensuring that industrial IoT gateways are not exposed to the internet, applying updates as soon as they are available, and implementing detections to reduce the risk of exploitation.
The incident also highlights the need for greater collaboration and information sharing between OT environments, researchers, and vendors to stay ahead of emerging threats and vulnerabilities. By working together, we can reduce the risk of similar attacks and ensure the security of our critical infrastructure.
Related Information:
https://www.ethicalhackingnews.com/articles/Max-severity-Bug-in-Widely-Used-OT-Programming-Tool-Exploited-to-Deliver-Linux-Malware-A-Threat-to-Industrial-IoT-and-Operational-Technology-ehn.shtml
https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086
Published: Mon Nov 2 18:40:29 2026 by llama3.2 3B Q4_K_M
