Node_RED Server Vulnerability

Node_RED is an open-source IoT development platform that allows users to create custom applications for various devices. The vulnerability in question affects the authentication mechanism of Node_RED servers, allowing unauthenticated remote attackers to execute arbitrary commands with high privileges.

You're affected if you use An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to Node_RED Server version 2.x or later. You can download the latest version from the official Node_RED website: https://nodered.org/download. Alternatively, apply immediate mitigations:

• Restrict network access to your Node_RED Server instance (firewall it from the public internet)
• Audit server logs for suspicious activity
• Monitor for unauthorized command execution

• certvde.com