---
id: "CVE-2026-109830"
page: "https://infrastack.ai/live/CVE-2026-109830"
kind: "vulnerability"
aliases: ["CVE-2026-109830"]
title: "meta-iot2050 firmware update tool runs commands from a config file as root; no fix released yet"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "meta-iot2050", "fixed": [], "affected": ">= V01.03.01 (all versions)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["command-injection", "embedded-linux", "industrial-iot", "infrastructure", "local", "meta-iot2050", "no-fix", "siemens", "simatic-iot2050"]
not_affected_if: ["config-file-not-writable-by-attacker"]
published_at: "2026-11-10T12:17:16+00:00"
first_seen_at: "2026-11-10T12:21:53+00:00"
updated_at: "2026-11-10T12:25:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109830", "first_seen_at": "2026-11-10T12:21:53+00:00"}, {"source": "analyst", "url": "https://productcert.siemens.com/productcert/html/ssa-724261.html", "first_seen_at": "2026-11-10T12:25:22+00:00", "cites": ["https://productcert.siemens.com/productcert/html/ssa-724261.html", "https://github.com/siemens/meta-iot2050/releases"]}]
exploit_sources: []
---

# meta-iot2050 firmware update tool runs commands from a config file as root; no fix released yet

Link for people: https://infrastack.ai/live/CVE-2026-109830 (this .md is for agents)

Siemens SSA-724261: the firmware update tool in meta-iot2050 (SIMATIC IOT2050 image layer) from V01.03.01 on passes parts of a configuration file to commands without checking them, so someone who can modify that file gets arbitrary commands run as root. CVSS is local, low privileges, user interaction required (7.3 v3.1 / 7.0 v4.0). Siemens says no fix is available; the fix is in the master branch and will ship in the next release. No exploitation or PoC reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:meta-iot2050 affected >= V01.03.01 (all versions) fixed no fixed version listed

## How to check

- Any IOT2050 image built from meta-iot2050 V01.03.01 or later is affected per Siemens; the GitHub releases list V01.06.04 as the latest, so no released version is fixed.
- Check who or what can write the configuration file that the firmware update tool reads; Siemens does not name the file path in the advisory (unknown). Restrict write access to trusted admins.
- Avoid running the firmware update tool against configuration files from untrusted sources.

## Fix

No released fix. Siemens (SSA-724261, 2026-11-10): the fix is already in the master branch of siemens/meta-iot2050 and will be published in the next release. Latest release seen on GitHub is V01.06.04. Until then follow Siemens' general security recommendations (network protection, industrial security guidelines).

## Timeline

- 2026-11-10T12:21:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109830
- 2026-11-10T12:25:22+00:00 analyst https://productcert.siemens.com/productcert/html/ssa-724261.html — Read Siemens SSA-724261 (primary): CWE-78 in firmware update tool, root, no fix yet, fix in master for next release. Triage's 'remote' question: AV:L, no remote vector stated. Mitigations: only generic Siemens guidance, none recorded. Config file path not named. Not verified: how_to_check (path unknown).

## Documents

- [advisory] SSA-724261: Command Injection Vulnerability in meta-iot2050 https://productcert.siemens.com/productcert/html/ssa-724261.html
- [mentions] Releases · siemens/meta-iot2050 https://github.com/siemens/meta-iot2050/releases

## From the sources

A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_