CVE-2026-58115

-red?style=flat-square Check · Exploit · Detection · PCAP · Impact · Write-up Disclaimer: This tool is provided for authorized security testing and educational purposes only. Only use against systems you own or have explicit written permission to test. Unauthorized access to computer systems is...

node-red-scanner

node-red-scanner Local triage for CVE-2026-58115, the 10.0 missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced gateways. Give it an Industrial OS version you own, or a settings.js file you own, and it tells you whether that install is still open. It never touches the...

Node RED Dashboard <2.26.2 - Local File Inclusion

NodeRED-Dashboard before 2.26.2 is vulnerable to local file inclusion because it allows uibase/js/..%2f directory traversal to read files. id: CVE-2021-3223 info: name: Node RED Dashboard 2.26.2 - Local File Inclusion author: gy741,pikpikcu severity: high description: NodeRED-Dashboard before...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA? FUXA is a free, open-source, web-based SCADA Supervisory Control and Data Acquisition and HMI Human-Machine Interface platform used for industrial automation , IoT , and real-time process visualization. It lets users build custom...

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 CVSS score: 10.0, is a case of missing authentication for a critical function that could be exploited by an...

Exploit for CVE-2026-58115

node-red-scanner Local triage for CVE-2026-58115, the 10...

VulnCheck KEV: CVE-2026-58115

A vulnerability has been identified in SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions V4.3.4-1 running Industrial OS with Node-RED installed, SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions running Example Image versions with Node-RED installed, SIMATIC IoT2050 Basic...

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

EUVD-2026-109947

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path via a Caddy reverse proxy. An unauthenticated attacker on the local network can exploit the Node-RED Admin API to deploy malicious flows, leading to remote code execution and full control over the home automatio...

PT-2026-123357

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

boneIO Black authorization issue vulnerability

In boneIO Black versions 1.3.0 through 1.6.0, there is an authorization issue vulnerability. This vulnerability arises because Caddy acts as a reverse proxy, exposing Node-RED instances on the /nodered path without authentication. The Node-RED Admin API permits the deployment of streams capable o...

GHSA-RXP7-6HXX-X8Q5 vulnerabilities

Vulnerabilities for packages: actions-runner, npm, code-server, wazuh-dashboard, wazuh-dashboard-fips, homepage, prism, unleash, lerna, graalvm, eco-jess, node-red, renovate, unleash-proxy...

CVE-2026-111997 vulnerabilities

Vulnerabilities for packages: actions-runner, npm, code-server, wazuh-dashboard, wazuh-dashboard-fips, homepage, prism, unleash, lerna, graalvm, eco-jess, node-red, renovate, unleash-proxy...

GHSA-P3HM-X653-5RC6 vulnerabilities

Vulnerabilities for packages: actions-runner, npm, code-server, wazuh-dashboard, wazuh-dashboard-fips, homepage, prism, unleash, lerna, graalvm, eco-jess, node-red, renovate, unleash-proxy...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...