{"id":"CVE-2026-109830","kind":"vulnerability","aliases":["CVE-2026-109830"],"related":[],"title":"meta-iot2050 firmware update tool runs commands from a config file as root; no fix released yet","description":"A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.","summary":"Siemens SSA-724261: the firmware update tool in meta-iot2050 (SIMATIC IOT2050 image layer) from V01.03.01 on passes parts of a configuration file to commands without checking them, so someone who can modify that file gets arbitrary commands run as root. CVSS is local, low privileges, user interaction required (7.3 v3.1 / 7.0 v4.0). Siemens says no fix is available; the fix is in the master branch and will ship in the next release. No exploitation or PoC reported.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"meta-iot2050","fixed":[],"affected":">= V01.03.01 (all versions)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["command-injection","embedded-linux","industrial-iot","infrastructure","local","meta-iot2050","no-fix","siemens","simatic-iot2050"],"not_affected_if":["config-file-not-writable-by-attacker"],"how_to_check":"- Any IOT2050 image built from meta-iot2050 V01.03.01 or later is affected per Siemens; the GitHub releases list V01.06.04 as the latest, so no released version is fixed.\n- Check who or what can write the configuration file that the firmware update tool reads; Siemens does not name the file path in the advisory (unknown). Restrict write access to trusted admins.\n- Avoid running the firmware update tool against configuration files from untrusted sources.","fix":"No released fix. Siemens (SSA-724261, 2026-11-10): the fix is already in the master branch of siemens/meta-iot2050 and will be published in the next release. Latest release seen on GitHub is V01.06.04. Until then follow Siemens' general security recommendations (network protection, industrial security guidelines).","status":"open","published_at":"2026-11-10T12:17:16+00:00","first_seen_at":"2026-11-10T12:21:53+00:00","triaged_at":"2026-11-10T12:22:37+00:00","updated_at":"2026-11-10T12:25:22+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T12:22:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"meta-iot2050: unchecked config file parts let an attacker run code","impact":"high","summary":"The meta-iot2050 layer for the SIMATIC IOT2050 industrial device executes parts taken from a configuration file without checking them. An attacker who can change that configuration file can make the device run arbitrary code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["meta-iot2050","siemens","simatic-iot2050","industrial-iot","embedded-linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the industrial device","analyst_note":"Check the NVD entry and the Siemens ProductCERT advisory for the fixed version, the config file path and whether remote access to it is possible.","how_to_check":"- Confirm the device runs meta-iot2050 at version `V01.03.01` or later, using the version the device or vendor reports (unknown if the sources do not say how to read it)\n- Check whether an attacker or untrusted process can write to the configuration file on the device (unknown if the sources name the file path)","plain_action":"","product_name":"meta-iot2050","needs_analyst":true,"not_affected_if":["config-file-not-writable-by-attacker"],"who_is_affected":"Devices running meta-iot2050 for All versions >= V01.03.01, the Siemens SIMATIC IOT2050 platform, are exposed. The attack needs the ability to manipulate the configuration file, so the exposure depends on who can write to it. unknown for the exact affected range beyond what the description states.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":4539,"output_tokens":624,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Siemens ProductCERT advisory for the fixed version, the config file path and whether remote access to it is possible.","search":"'-109830':21A,24A '-2026':20A,23A '-724261':51B '7.0':101B '7.3':99B 'abl':159C 'affect':140C 'allow':154C 'arbitrari':86B,170C 'attack':156C 'avail':108B 'branch':115B 'check':76B 'code':171C 'command':8A,29B,74B,87B 'command-inject':28B 'config':11A 'configur':71B,146C,163C 'could':153C 'cve':19A,22A 'cvss':91B 'devic':141C,174C 'embed':32B 'embedded-linux':31B 'execut':149C,169C 'exploit':124B 'file':12A,72B,84B,147C,164C 'firmwar':4A,53B 'fix':16A,44B,106B,110B 'get':85B 'identifi':132C 'imag':62B 'industri':35B 'industrial-iot':34B 'infrastructur':37B 'inject':30B 'interact':97B 'iot':36B 'iot2050':3A,27A,41B,48B,59B,61B,136C 'layer':63B 'linux':33B 'local':38B,93B 'low':94B 'make':166C 'manipul':161C 'master':114B 'meta':2A,26A,40B,58B,135C 'meta-iot2050':1A,25A,39B,57B,134C 'modifi':82B 'next':121B 'no-fix':42B 'part':68B,143C 'pass':67B 'poc':126B 'privileg':95B 'releas':17A,122B 'report':127B 'requir':98B 'root':14A,90B 'run':7A,88B 'say':104B 'ship':118B 'siemen':45B,49B,103B 'simat':47B,60B 'simatic-iot2050':46B 'someon':79B 'ssa':50B 'take':142C 'tool':6A,55B 'uncheck':151C 'updat':5A,54B 'user':96B,168C 'v01.03.01':65B,139C 'v3.1':100B 'v4.0':102B 'version':138C 'vulner':129C 'without':75B 'yet':18A","nicknames":[],"mitigations":[],"who_affected":"Devices running a meta-iot2050 image (the Debian-based software layer for SIMATIC IOT2050) from V01.03.01 on, all versions, per Siemens. The attacker must be able to change a configuration file used by the firmware update tool and a user has to trigger it; commands then run as root. Systems where only trusted admins can touch that file are at much lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-10T12:25:22Z","by":"analyst","doc":"https://productcert.siemens.com/productcert/html/ssa-724261.html","run_id":2452},"products":{"at":"2026-11-10T12:25:22Z","by":"analyst","doc":"https://productcert.siemens.com/productcert/html/ssa-724261.html","run_id":2452},"who_affected":{"at":"2026-11-10T12:25:22Z","by":"analyst","doc":"https://productcert.siemens.com/productcert/html/ssa-724261.html","run_id":2452}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["metaiot2050"],"ptokens":["iot2050","meta"],"labels":["commandinjection","embeddedlinux","high","industrialiot","infrastructure","local","metaiot2050","nofix","siemens","simaticiot2050","vendor"],"campaign_type":null,"search_a":"'-109830':21A,24A '-2026':20A,23A 'command':8A 'config':11A 'cve':19A,22A 'file':12A 'firmwar':4A 'fix':16A 'iot2050':3A,27A 'meta':2A,26A 'meta-iot2050':1A,25A 'releas':17A 'root':14A 'run':7A 'tool':6A 'updat':5A 'yet':18A","search_b":"'-724261':51B '7.0':101B '7.3':99B 'arbitrari':86B 'avail':108B 'branch':115B 'check':76B 'command':29B,74B,87B 'command-inject':28B 'configur':71B 'cvss':91B 'embed':32B 'embedded-linux':31B 'exploit':124B 'file':72B,84B 'firmwar':53B 'fix':44B,106B,110B 'get':85B 'imag':62B 'industri':35B 'industrial-iot':34B 'infrastructur':37B 'inject':30B 'interact':97B 'iot':36B 'iot2050':41B,48B,59B,61B 'layer':63B 'linux':33B 'local':38B,93B 'low':94B 'master':114B 'meta':40B,58B 'meta-iot2050':39B,57B 'modifi':82B 'next':121B 'no-fix':42B 'part':68B 'pass':67B 'poc':126B 'privileg':95B 'releas':122B 'report':127B 'requir':98B 'root':90B 'run':88B 'say':104B 'ship':118B 'siemen':45B,49B,103B 'simat':47B,60B 'simatic-iot2050':46B 'someon':79B 'ssa':50B 'tool':55B 'updat':54B 'user':96B 'v01.03.01':65B 'v3.1':100B 'v4.0':102B 'without':75B","search_c":"'abl':159C 'affect':140C 'allow':154C 'arbitrari':170C 'attack':156C 'code':171C 'configur':146C,163C 'could':153C 'devic':141C,174C 'execut':149C,169C 'file':147C,164C 'identifi':132C 'iot2050':136C 'make':166C 'manipul':161C 'meta':135C 'meta-iot2050':134C 'part':143C 'take':142C 'uncheck':151C 'user':168C 'v01.03.01':139C 'version':138C 'vulner':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productcert@siemens.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109830","severity":null,"published_at":"2026-11-10T12:17:16+00:00","modified_at":"2026-11-10T12:17:16+00:00","first_seen_at":"2026-11-10T12:21:53+00:00","fetched_at":"2026-11-10T12:21:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109830:2452","url":"https://productcert.siemens.com/productcert/html/ssa-724261.html","severity":null,"published_at":"2026-11-10T12:25:22+00:00","modified_at":"2026-11-10T12:25:22+00:00","first_seen_at":"2026-11-10T12:25:22+00:00","fetched_at":"2026-11-10T12:25:22+00:00","note":"Read Siemens SSA-724261 (primary): CWE-78 in firmware update tool, root, no fix yet, fix in master for next release. Triage's 'remote' question: AV:L, no remote vector stated. Mitigations: only generic Siemens guidance, none recorded. Config file path not named. Not verified: how_to_check (path unknown).","cites":["https://productcert.siemens.com/productcert/html/ssa-724261.html","https://github.com/siemens/meta-iot2050/releases"]}],"documents":[{"id":114955,"url":"https://productcert.siemens.com/productcert/html/ssa-724261.html","title":"SSA-724261: Command Injection Vulnerability in meta-iot2050","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114956,"url":"https://github.com/siemens/meta-iot2050/releases","title":"Releases · siemens/meta-iot2050","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}