Provenance Record

News, 1051 words (range 400-1200), 7 sources. Clear structure (Overview, record contents, dated sequence, one model then four, Node-RED or the device, what the canary saw, what is not established). Neutral tone; the two framings (Register: Node-RED bug; NVD/Siemens: devices that do not enforce authentication) are both laid out with quotes; Herald-own checks are labelled and dated; no AI self-reference; no relative dates. Title is 146 characters (under 150, noted only because it is long).

Snapshots (gunzip, tag-stripped) read from sources/2026-11/vulncheck-honeypots-saw-cve-2026-58115-exploited-via-node-red-on-october-30-siemens-sourced-nvd-record-now-names-four-iot2050-models-up-from-one/ ; manifest: all 7 status 200, no archive fallback, suspicious_patterns null for all 7 (no injection text found; none reported). SOURCE 0 The Register (source-0): CONFIRMED. Published 'mon 2 Nov 2026 // 22:55 UTC', byline Jessica Lyons. Quote 'On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115' by 'VulnCheck researcher Patrick Garrity' in a 'Monday advisory' (Monday = Nov 2); 'trivial to weaponize' (inject node + exec node, descriptions match); single IP 4.201.105[.]116 in Microsoft AS8075, geolocates to Brazil; filename bot-linux-amd64; 'We did not fetch the binary, so we can't say what it does once running.'; 'Between October 30 and November 1 ... target the same Node-RED vulnerability 16 times, and log 125 hits against eight different CVEs across their wider canary network'; 'opportunistic mass scanning rather than a targeted attack'; 'In August, Siemens assigned the vulnerability identifier'; in VulnCheck KEV, not (as of press time) in CISA KEV; headline 'Max-severity bug in widely used OT programming tool' and text 'a maximum-severity vulnerability in Node-RED, a flow-based programming tool that is widely used in critical infrastructure' and 'Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface' all verbatim. The Register uses 'canaries', never 'honeypots'; the article uses 'canary systems' for the Register's statement and 'honeypots' only where THN/heise use it. SOURCE 1 The Hacker News (source-1): CONFIRMED. Dated 'Nov 03, 2026', Ravie Lakshmanan. 'SIMATIC IoT2050 Advanced devices'; 'CVSS score: 10.0'; 'against its honeypot network' (As of October 30, 2026); 'has been remediated in versions 4.3.4.1 or later'; Siemens recommends uninstalling or hardening Node-RED; two-stage wget.sh; /tmp/.kworker; 'The exact functionality of wget.sh or .kworker remains unknown, as they could not be retrieved'; Garrity 'This backdoor survives even if a memory-backed implant is lost on reboot' (article quote is an exact substring). SOURCE 2 heise online (source-2 English edition, plus German original fetched live, 200, sha256 cd68e595b73dbf03...): CONFIRMED and counted as ONE account (English 'translated with technical assistance'; German original 11509246 datePublished 2026-11-03T12:09+01:00, English datePublished 2026-11-03T13:52+01:00). 'logged an attempt last Friday' (Oct 30); 'By Sunday, VulnCheck had counted 16 attacks ... from the same IP address'; 'seven other vulnerabilities'; Advanced devices, versions earlier than 4.3.4.1; 'VulnCheck did not investigate exactly what the botnet malware does'; 'IT administrators must install it themselves'; update '06.11.2026, 18:20 Uhr' (English) / '06.11.2026, 18:13 Uhr' (German), no time zone on the update line: 'Siemens emphasizes that no successful attacks on Simatic IoT2050 gateways have been reported. VulnCheck also reiterated this in an update to the fourth paragraph of its security advisory, clarifying that the attacks targeted honeypots rather than actual gateways.' German: 'kein erfolgreicher Angriff ... bekannt wurde' - the article's attribution to Siemens and to VulnCheck is correct. SOURCE 3 NVD (source-3 snapshot is the 2.6 KB Angular JavaScript shell 'NVD - Home', unusable; sha256 69cad315...): read instead through the NVD CVE API 2.0 on 2026-11-09 10:06 UTC (services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58115, sha256 5f8ee08d...) and the NVD change-history API (cvehistory/2.0, sha256 3190e4cd...), cross-checked with CVE.org's CVE record JSON (cveawg.mitre.org, sha256 da3343a0...). CONFIRMED: sourceIdentifier [email protected]; published 2026-08-11T13:19:00.190; lastModified 2026-11-04T18:17:45.050; status Awaiting Analysis; description names Advanced (6ES7647-0BA00-1YA2), Basic (-0YA2), M.2 (6ES7647-0BB00-1YA2), SM (6ES7647-0CA00-1AA2), each 'All versions < V4.3.4-1 running Industrial OS with Node-RED installed'; quoted sentence verbatim; cvssMetricV31 and cvssMetricV40 base 10.0, type Secondary, source [email protected], no NVD-sourced score; SSVC by 134c704f... role 'CISA Coordinator', timestamp 2026-08-12T17:59:33Z, exploitation none / automatable yes / technicalImpact total; only reference cert-portal.siemens.com/productcert/html/ssa-834709.html. CHANGE HISTORY (new evidence for the headline's 'now ... up from one'): the creation event 2026-08-11T13:19 described 'SIMATIC IoT2050 Advanced ... (All versions < V4.3.4.1 ...)' only; the single description change is 'CVE Modified' 2026-11-04T18:17:45 by sourceIdentifier [email protected], replacing it with the four-model text and 'V4.3.4-1'. CVE.org dateUpdated 2026-11-04T17:45:30Z, assigner siemens, dateReserved 2026-06-29. So 'Siemens-sourced', 'now' and 'up from one' are supported by the record itself, not only by a comparison of two reads; the article states only the last-modified time and labels the comparison as its own, which is the more conservative framing. NVD API timestamps are UTC (consistent with the Z-stamps on CVE.org and GitHub). The article's V4.3.4-1 vs 4.3.4.1 point holds, and the history shows NVD's own text changed spelling on Nov 4 (not reconciled by any source). SOURCE 4 GitHub advisory GHSA-mmh6-f99q-64fh (source-4): CONFIRMED. 'Unreviewed', 'Published by the National Vulnerability Database' 2026-08-11T13:19:00Z, published to GitHub Advisory Database 2026-08-11T15:32:36Z, 'Last updated Aug 11, 2026', description names only SIMATIC IoT2050 Advanced, 'All versions < V4.3.4.1'; GitHub REST API returned 403 (rate limit) so the rendered page snapshot was used. SOURCE 5 Node-RED docs source (source-5 and raw.githubusercontent.com fetch, sha256 b0b0fad3...): CONFIRMED. line 10 'By default, the Node-RED editor is not secured - anyone who can access its IP address can access the editor and deploy changes.'; 'To enable user authentication on the Editor and Admin API, uncomment the `adminAuth` property in your settings file'. SOURCE 6 node-red/node-red security advisories (source-6 and live fetch 2026-11-09 10:07 UTC, sha256 12ebb07a...): CONFIRMED. Two published advisories, GHSA-m33v-338h-4v9f and GHSA-xp9c-82x8-7f67, both 'published Feb 19, 2021' by knolleary; none for CVE-2026-58115. HERALD-OWN CHECKS RE-RUN: CISA KEV JSON feed fetched 2026-11-09 10:07 UTC (sha256 47e0406b...): catalogVersion 2026.11.06, dateReleased 2026-11-06T19:44:45Z, 1769 entries, zero for CVE-2026-58115 - matches the article; the article gives the feed version and release time but not the date of its check (minor, the version identifies the state). Advisories count (2, both 2021) matches and is dated 2026-11-09 in the article. The four-model comparison is labelled the Herald's own. Dates: Oct 30 = Friday, Nov 1 = Sunday (heise 'By Sunday'), Nov 2 = Monday; dated sequence is in chronological order and the article states 'Dates are as the sources state them'; no source gives a time zone for Oct 30 and the article does not assert one. Quantifier/absence scan (jq|grep run on title, summary, body): every 'both', 'each', 'only', 'none', 'all' line checked against all seven sources - 'both 10.0 scores' (v3.1 and v4.0 both 10.0), 'each with ... V4.3.4-1' (4 of 4), 'only reference' (NVD lists one), 'names only Advanced' (GitHub), 'both name the Advanced model' (THN, heise), 'two ... both from 2021 and neither for this CVE', 'None of the cited sources reports a compromised production Siemens device / a Node-RED project advisory or release / says why the product list was extended / whether the spellings denote the same build' - none contradicted by any of the seven. Allowlist: theregister.com, thehackernews.com, heise.de, nvd.nist.gov, github.com all present (www stripped); vulncheck.com and cert-portal.siemens.com are not on the list and are not cited (article says so; siemens.com is listed but allowlist matching is exact hostname); every fact from VulnCheck/Siemens reaches the article through a cited source. No orphan URLs: all 7 body URLs are in article.sources and vice versa. Anthropic disclosure: not required - the article does not concern Anthropic or an Anthropic product and names Anthropic nowhere. INDEPENDENT-SOURCE COUNT (News, so no Analysis threshold): 3 independent outlets - The Register (adds reporting: IP/ASN, filename, 125 hits across eight CVEs, quotes from the Monday advisory), The Hacker News (adds payload and backdoor detail, Siemens advisory quote), heise online (adds Siemens statement and honeypot clarification of 2026-11-06; German and English editions = one account). All three relay a single origin, VulnCheck's own advisory, so the telemetry itself has no independent corroboration (the article says VulnCheck's post is not cited). Primary records: NVD, GitHub advisory copy (derived from NVD, not independent of it), Node-RED docs and advisories page.

No factual errors found in headline, summary, lead or body. Title: 'VulnCheck Honeypots Saw ... Exploited via Node-RED on October 30' matches The Register ('canaries'), THN ('honeypot network', 'As of October 30, 2026') and heise (update: honeypots); 'Siemens-Sourced NVD Record Now Names Four IoT2050 Models, Up From One' matches NVD change history (Siemens-sourced edit of 2026-11-04 from one model to four) and GitHub's August copy (one). Summary 'logged exploitation ... between October 30 and November 1' is the Register's wording ('caught an attacker exploiting', 16 targetings Oct 30-Nov 1); heise calls them 'attempts' and the body keeps that distinction and the no-production-compromise caveat. CVSS 10.0: scored by Siemens ([email protected], secondary), both v3.1 and v4.0, NVD has none of its own. Observations, none requiring a correction: (1) the Register says Siemens 'assigned the identifier' in August; CVE.org shows reserved 2026-06-29, published 2026-08-11 - the article attributes the statement to The Register and itself uses the NVD publication date; (2) NVD's Spanish translation (Oct 23) still reflects the single-model text, consistent with the Nov 4 edit; (3) the article does not state the date of its KEV feed check (version 2026.11.06 given).

Accurate, carefully scoped News article. Every quote, number, date, version and attribution verified against raw source text (NVD via its JSON and history APIs because the stored snapshot is a JavaScript shell); the Herald-own comparisons and checks were recomputed on 2026-11-09 and hold. Verdict APPROVE with no corrections. Featured candidacy: 1 - accurate coverage of a CVSS 10.0 missing-authentication flaw on Siemens IoT2050 gateways, honeypot-only exploitation, of interest to an ICS/OT security audience rather than a broad one