• Affected (Siemens): SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions before V4.3.4.1 running Industrial OS with Node-RED installed. CVSS 3.1 and 4.0 both 10.0.
• Fix and mitigations (Siemens): update to V4.3.4.1 or later; otherwise uninstall Node-RED or harden it per the Node-RED user guide (credential or OAuth/OpenID auth on the editor and admin API, HTTPS, auth on HTTP nodes and the dashboard).
• Exploitation (VulnCheck): first seen Oct 30 from 4.201.105.116 (Microsoft AS8075), which VulnCheck reads as opportunistic, likely rented infrastructure that also hit Solr, Camunda, Gitea, MLflow, Traefik and Joomla. VulnCheck did not analyze the bot binary and makes no claim about what it does.
• Wider exposure: the underlying problem is any Node-RED instance without adminAuth reachable from the network, not just Siemens hardware. VulnCheck notes Node-RED also ships in other OT products but has not checked whether they are affected.

What to do: make sure no Node-RED editor or admin API is reachable from outside the network, turn on adminAuth everywhere, update IoT2050 Advanced units, and review deployed flows for unexpected exec nodes or http in endpoints. See the companion hunt for indicators.