Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity vulnerability (CVE-2026-58115, CVSS 10.0) in Siemens SIMATIC IoT2050 Advanced devices is being actively exploited in the wild. The flaw involves missing authentication for a critical function, allowing unauthenticated remote attackers to execute arbitrary code. Attackers are leveraging this vulnerability to plant remote command backdoors on affected devices. The issue was disclosed by VulnCheck. The affected product is Siemens SIMATIC IoT2050 Advanced, an industrial IoT gateway device. The critical nature of the vulnerability and its active exploitation make it a high-priority concern for industrial and operational technology environments. Organizations using these devices are urged to apply patches or mitigations immediately.