Ongoing Vulnerabilities in Node-RED Pose Risks to IoT Systems
Months after Siemens issued critical updates to address an authentication vulnerability in Node-RED, many users have yet to implement these fixes, leading to a rise in exploitations in active environments. This situation highlights the risks associated with open-source Internet of Things (IoT) and Industrial Internet of Things (IIoT) systems, particularly those integrated into essential infrastructures yet not governed by Chief Information Security Officers (CISOs) or Chief Information Officers (CIOs).
A security firm known as VulnCheck recently discovered exploits targeting this vulnerability, specifically relating to an unauthenticated Node-RED admin API flaw labeled as CVE-2026-58115. This was detailed in a blog post released on Monday, shedding light on the alarming frequency of attacks. One notable incident occurred on October 30, when a monitoring system flagged an attacker utilizing this specific flaw to deploy a malicious flow that downloaded and executed a Linux bot. The request originated from an IP address within Microsoft’s Autonomous System Network (ASN), indicating a more sophisticated actor at play. Since then, multiple attempts—16 in total—have been recorded from the same IP, showcasing the repeated exploitation of this vulnerability across various payloads.
The root of this issue lies in Node-RED’s default settings, which ship with authentication disabled. Users are expected to enable this feature before deploying the tool, but this practice is often neglected. Patrick Garrity, a researcher at VulnCheck who authored the blog post, noted that Node-RED is particularly appealing to individuals outside of IT spheres, making it susceptible to such oversights. "These deployments are frequently initiated by individuals who may not possess the technical expertise needed to secure them properly," he remarked during an interview.
Aman Mahapatra, the Chief Strategy Officer at Tribeca Softech, a technology consulting firm based in New York City, supports this observation. He explained that the underlying vulnerability in Node-RED is not a new phenomenon. "This is a longstanding issue,” he stated. "Unless an administrator explicitly configures authentication, anyone with access to the editor can deploy flows. The project’s own documentation openly acknowledges this." This situation mirrors incidents like recent supermarket refrigeration attacks, where equipment has been installed beyond the scope of security teams, reachable from the open internet, and often without proper authentication protocols in place.
Mahapatra elaborated on the broader implications of these vulnerabilities. Node-RED often serves as integration middleware connecting various industrial and cloud services, which increases the risks associated with its compromise. Each instance has the potential to act as a credential vault, safeguarding access credentials for multiple systems, thereby creating a precarious intersection between operational technology (OT) and information technology (IT). "Should such a deployment be compromised, it may serve as a bridge across a network diagram where no such connectivity is intended," he cautioned.
Compounding the issue is the nature of patching practices within industrial environments. Unlike IT systems, which can often receive updates in real time, industrial system fixes are typically executed during pre-scheduled maintenance periods. Mahapatra emphasized that Siemens published its advisory on August 11, yet VulnCheck detected exploitation of the flaw on October 30—just three days after it released its own detection mechanisms. He remarked, “Given that numerous gateways will remain unpatched through next year due to the lengthy update cycles in operational technology, this could lead to significant vulnerabilities."
Providing further insight, Frank Dickson, principal analyst at Dickson Research, expressed mixed feelings about the current situation. While it is encouraging that the exploited attacks haven’t explicitly targeted industrial systems, the unfortunate reality remains that access to those systems has been achieved regardless.
Noah Kenney, a principal consultant at Digital 520, concurred with Dickson’s assessment. He noted that attackers don’t necessarily need intricate knowledge of the connected equipment or operations; they are primarily in search of vulnerable systems capable of executing their commands. This situation raises alarming prospects where industrial operations might be disrupted by attackers who had no original intent to target critical infrastructure. Even relatively benign malware aimed at consuming system resources or interfering with network communication can have far-reaching operational consequences.
Additionally, Dickson highlighted that merely patching the vulnerabilities would not eliminate the overall threat exposure. “The report indicates that some attackers have bypassed bot deployment, opting instead to install web shells—hidden back doors that allow them to issue commands later," he stated. In essence, while closing this exploit is crucial for future protection, it is equally important to assess and evict any intruders that may already be lurking within the system.
This situation serves as a stark reminder of how crucial it is for organizations to prioritize cybersecurity practices, particularly in environments that integrate IoT and IIoT systems, which tend to be extraordinarily susceptible to negligence and exploitation.