ICS/OT
Node-RED'dagi jiddiy zaiflik hujumlarda ekspluatatsiya qilinmoqda
Xakerlar turli yuklamalarni, jumladan Linux botini va vebshellarni joylashtirish maqsadida bir xil IP manzildan bir nechta hujumlarni amalga oshirdilar.
Muallif
Ionut Arghire
| 2026-yil 3-noyabr (ET vaqti bilan 8:10)
Xakerlar Node-RED'dagi jiddiy darajadagi zaiflikni turli yuklamalarni joylashtirish uchun ekspluatatsiya qilishni boshladilar, deb xabar beradi zaiflik razvedkasi kompaniyasi VulnCheck.
Node-RED — bu brauzerga asoslangan muharrir orqali hodisalarga asoslangan ilovalarni yaratishni qo'llab-quvvatlaydigan past kodli, oqimga asoslangan dasturlash vositasi. U turli sohalardagi, jumladan tijorat ICS/OT qurilmalaridagi mahsulotlarda ishlatiladi.
CVE-2026-58115 (CVSS balli 10/10) sifatida kuzatiladigan bu xato Node-RED HTTP interfeysida autentifikatsiyaning yo'qligi muammosi sifatida tavsiflanadi, bu esa hujumchilarga tizim buyruqlarini bajarishi mumkin bo'lgan dasturlash tugunlariga kirish imkonini beradi.
Siemens uni 11-avgustda, SIMATIC IoT2050 Advanced qurilmalarida Industrial OS bilan Node-RED o'rnatilgan holda topganidan so'ng e'lon qildi. SIMATIC IoT2050 Advanced 4.3.4.1 va undan keyingi versiyalari ushbu xavfsizlik teshigi uchun tuzatishlarni o'z ichiga oladi.
Siemens ma'lumotiga ko'ra, CVE-2026-58115 «autentifikatsiya qilinmagan masofaviy hujumchiga zararli oqimlar yaratish va asosiy serverda maksimal imtiyozlar bilan ixtiyoriy kodni bajarish imkonini berishi mumkin».
Yakshanba kuni VulnCheck zaiflikning 30-oktabrda haqiqiy dunyoda muvaffaqiyatli ekspluatatsiya qilinganini kuzatganini ogohlantirdi. Hujum Microsoft tarmog'i bo'lgan AS8075'dagi IP manzildan kelgan va to'liq eksploitni yetkazib bergan.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
«U Node-RED oqimini joylashtirdi, uni avtomatik ravishda ishga tushirdi va hujumchi nazoratidagi serverdan binar faylni uch qatlamli kodlash ortidan yuklab oldi», — deydi VulnCheck.
Yuklama Linux bot edi va bajarish buyrug'i o'rnatish muvaffaqiyatli bo'lganini tekshirmadi. Fayl nomiga asoslanib, kompaniya hujumchilar bir nechta arxitekturalar uchun yuklamalar tayyorlagan deb hisoblaydi.
1-noyabrga kelib, VulnCheck xuddi shu IP manzildan 15 ta qo'shimcha hujumni kuzatdi, ular qo'shimcha yuklamalarni, jumladan buzilgan serverlarda ixtiyoriy buyruqlarni bajarish imkonini beradigan doimiy vebshellarni yetkazib berdi.
Kompaniya ma'lumotiga ko'ra, hujumlar tahdid aktorlari adminAuth'siz Node-RED nusxalarini faol ravishda skanerlash va ularni bitta HTTP so'rovi bilan avtomatik ravishda ekspluatatsiya qilishini ko'rsatadi.
«Agar siz Node-RED'ni biror joyda, jumladan ICS/OT muhitida o'rnatilgan holda ishlatsangiz, bugun u tashqi tarmoqdan kirish mumkinligini tekshiring. Shuningdek, kutilmagan exec tugunlari yoki HTTP endpointlari uchun joylashtirilgan oqimlarni ko'rib chiqing, chunki ba'zi hujumchilar botlar emas, balki vebshellar qoldirmoqda», — deb ta'kidlaydi VulnCheck.
Bog'liq: Ivanti Connect Secure hujum zanjirida ekspluatatsiya qilingan yana ikkita nol kunlik zaiflikni tuzatdi
Bog'liq: PHP2Shell hujumlari Palo Alto Firewalls'ni ildizdan buzdi, lekin WordPress'ga qarshi muvaffaqiyatsiz bo'ldi
Bog'liq: Yangi WordPress zaifligi hujumchilarning nishonida
Bog'liq: Drupal Commerce Core zaifligi onlayn do'konlarga qarshi ekspluatatsiya qilinmoqda
Yozgan
Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborot byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghire'dan ko'proq
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack
- Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
- Fresh WordPress Vulnerability in Attackers' Crosshairs
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians' Machines
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
So'nggi yangiliklar
- Buyuk Britaniya kiber rahbari 2028-yilga kelib Buyuk Britaniya muhim infratuzilmaga AI kiberhujumlari bilan duch kelishini aytdi
- Google 1,3 million Android qurilmasidan iborat XCPE botnetini yo'q qildi
- NATO'ning Crossed Swords mashqi kiberoperatsiyalarni o'qitishga AI agentlarini jalb qildi
- 100 dan ortiq Yevropa do'konlari Supermarket muzlatgich hujumlari qaytishi bilan zararlangan
- Kiberxavfsizlik M&A Roundup: 2026-yil oktyabrda 37 ta bitim e'lon qilindi
- Florida Talabalar yordami veb-sayti xakerligi 4,9 million kishining ma'lumotlarini xavf ostiga qo'ydi
- Revolve ma'lumotlar buzilishi kamida 200 000 kishiga ta'sir qildi
- Google $250 000 Root-in-Cloud Bug Bounty mukofotini joriy qildi
Trendda
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
FBI Shimoliy Koreya Binance o'g'irligiga bog'liq 600 dan ortiq manzilni belgiladi
Ivanti Connect Secure hujum zanjirida ekspluatatsiya qilingan yana ikkita nol kunlik zaiflikni tuzatdi
PHP2Shell hujumlari Palo Alto Firewalls'ni ildizdan buzdi, lekin WordPress'ga qarshi muvaffaqiyatsiz bo'ldi
Northstar Security Stealth'dan $7M bilan zaharli xavf kombinatsiyalarini ochish uchun chiqdi
Kiberxavfsizlik M&A Roundup: 2026-yil oktyabrda 37 ta bitim e'lon qilindi
Revolve ma'lumotlar buzilishi kamida 200 000 kishiga ta'sir qildi
Drupal Commerce Core zaifligi onlayn do'konlarga qarshi ekspluatatsiya qilinmoqda
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalar, shuningdek, soha mutaxassislarining chuqur fikr-mulohazalari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborot byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Agentic Pentesting for a Stronger CTEM Program
2026-yil 4-noyabr
Pentestlar orasidagi xavfsizlik bo'shliqlarini yoping. CTEM dasturingizda doimiy ta'sirni tekshirish uchun agentik pentestingni o'rganish maqsadida ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 Summit
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Barracuda Dan Fletcher'ni CFO etib tayinladi.
Artemis Security Arun Singh'ni CGO etib tayinladi.
General Paul M. Nakasone Armadin Kengashiga qo'shildi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
Parollar Passkey'lardan yaxshiroq. Lekin ular yetarli emas.
Tashkilotlar parollarni yo'q qilganda, hujumchilar moslashadi. Autentifikatorni to'g'ridan-to'g'ri hujum qilish o'rniga, ular uning atrofidagi imkoniyatlarni qidiradilar. (Torsten George)
Xavf shaxsiy bo'lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o'rganishi mumkin
Xavf menejerlari zaif signallarni aniqlash, buzilishlarga tayyorgarlik ko'rish va noaniqlik ostida qiyin qarorlar qabul qilishga o'rgatilgan. Ammo bu intizom tizim yoki korxona emas, balki siz bo'lganingizda boshqacha ko'rinadi. (Steve Durbin)
Hech kim xavfsizlik anketasiga ishonmaydi. Biz baribir unga tayanamiz.
Deyarli har bir B2B bitimni nazorat qiladigan jarayon — yuboruvchi ishonmaydigan va qabul qiluvchi qabul qiladigan o'z-o'zini baholash. Nihoyat, kompaniyalar o'rtasida ishonch uchun yaxshiroq asos bor. (Sravish Sridhar)
Bu normal: NetScaler nol kunliklari bizga yangi normal haqida nimani aytadi
Yaqinda Citrix NetScaler tuzatishlari chiqarilishi mumkin bo'lsa, yamoq boshqaruvi quvurlarini tayyor saqlang. (Tod Beardsley)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda joylashgani xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi. (Matias Madou)
ICS/OT
Critical Node-RED Flaw Exploited in Attacks
Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.
By
Ionut Arghire
| November 3, 2026 (8:10 AM ET)
*
Hackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports.
Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices.
Tracked as CVE-2026-58115 (CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.
Siemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.
According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”
On Sunday, VulnCheck warned that it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.
Advertisement. Scroll to continue reading.
“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.
The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.
By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.
According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.
“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.
Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Related:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Related:Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related:Drupal Commerce Core Vulnerability Exploited Against Online Stores
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack
- Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
- Fresh WordPress Vulnerability in Attackers’ Crosshairs
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
Latest News
- UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
- Google Dismantles XCPE Botnet of 1.3 Million Android Devices
- NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training
- Over 100 European Stores Hit as Supermarket Fridge Attacks Return
- Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
- Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
- Revolve Data Breach Impacts at Least 200,000 People
- Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
Trending
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
Revolve Data Breach Impacts at Least 200,000 People
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
More People On The Move
Expert Insights
*
Passkeys Are Better Than Passwords. But They Are Not Enough.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)