Technology news and discussion on TalkFuse.
Attackers exploit critical Node-RED flaw to target exposed Linux devices
Criminals are exploiting a maximum-severity Node-RED vulnerability to install Linux malware on exposed devices. The tool is used to automate workflows in industrial control and operational technology systems, so attacks on connected equipment can carry risks beyond ordinary IT disruption.
The flaw, CVE-2026-58115, has a CVSS score of 10 and allows unauthenticated access to programming nodes on affected Siemens devices, enabling attackers to run system commands. VulnCheck observed one IP address exploit it 16 times between 30 October and 1 November, alongside attempts against seven other vulnerabilities. Researchers have not retrieved the malware, and say the broad mix of targets suggests opportunistic scanning; they advise checking exposure, applying available updates and adding detections.
In short
- Attackers are exploiting a maximum-severity Node-RED bug.
- VulnCheck recorded 16 attempts against the flaw in three days.
- Researchers urge users to check exposure and apply updates.
Explained simply
Node-RED is a tool for connecting devices and automating tasks by linking together visual programming blocks. It is used in industrial control and operational technology systems, which monitor or operate equipment such as machinery and building systems.
Siemens makes some devices that can run Node-RED. The reported flaw can let someone without an account access programming functions on affected devices and run commands on their Linux systems. Researchers say they saw repeated attempts to exploit it, but have not recovered the malware involved.
A compromised device could affect the systems it helps control, so the issue may extend beyond disruption to ordinary business computers. The risk depends on whether an affected device is exposed and vulnerable; updates and checks for suspicious activity can help organisations assess and reduce that risk.
Read the full article at the source →
Originally published by The Register as “Max-severity bug in widely used OT programming tool exploited to deliver Linux malware”.