PT-2018-16573 · Siemens · Siclock Tc400+1

Publicado 2018-07-03 · Atualizado 2019-10-09 · CVE-2018-4855

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SICLOCK TC100 (All versions) SICLOCK TC400 (All versions)

Description A vulnerability has been identified that involves the unencrypted storage of passwords in client configuration files and during network transmission. This could allow an attacker in a privileged position to obtain access passwords.

Recommendations For SICLOCK TC100, consider encrypting passwords in client configuration files and securing network transmission to prevent unauthorized access. For SICLOCK TC400, consider encrypting passwords in client configuration files and securing network transmission to prevent unauthorized access. As a temporary workaround, consider restricting access to the client configuration files and network transmission to minimize the risk of exploitation.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2018-4855

Produtos afetados

Siclock Tc100

Siclock Tc400

Referências · 3

• http://securityfocus.com/bid/104672 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-4855 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf · Aviso do Fabricante