Security researchers at VulnCheck have disclosed active exploitation of a maximum-severity vulnerability affecting Siemens SIMATIC IoT2050 Advanced devices, with attackers using the flaw to plant remote command backdoors on compromised systems.
The vulnerability, tracked as CVE-2026-58115, carries a CVSS score of 10.0, the highest possible severity rating. It stems from a missing authentication check on a critical function, which allows an unauthenticated remote attacker to execute arbitrary code on affected devices without needing any credentials.
What’s Affected
The flaw impacts SIMATIC IoT2050 Advanced devices, part of Siemens’ industrial IoT gateway product line used in operational technology and edge computing environments.
Why It Matters
A missing authentication vulnerability with a perfect CVSS score is about as severe as it gets. Because exploitation requires no authentication, any internet-exposed or improperly segmented IoT2050 Advanced device is a potential target. Active exploitation means the window for defenders to patch or mitigate has already narrowed significantly.
Remote command backdoors planted via this flaw could give attackers persistent access to industrial networks, potentially enabling further lateral movement, data exfiltration, or disruption of connected operational technology systems.
- Vulnerability: Missing authentication for a critical function
- Impact: Unauthenticated remote code execution
- CVSS Score: 10.0 (maximum severity)
- Status: Actively exploited in the wild
Recommended Actions
Organizations running SIMATIC IoT2050 Advanced devices should immediately check Siemens’ advisories for patch availability and apply any available firmware updates. Until a fix is confirmed and deployed, security teams should ensure these devices are not exposed directly to the internet, restrict network access through firewalls or segmentation, and monitor for signs of unauthorized remote command execution or unexpected configuration changes.
