PT-2018-16572 · Siemens · Siclock Tc400+1

Published 2018-07-03 · Updated 2019-10-09 · CVE-2018-4854

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SICLOCK TC100 (All versions) SICLOCK TC400 (All versions)

Description A vulnerability has been identified that allows an attacker with network access to port 69/udp to modify the administrative client stored on the device. If a legitimate user downloads and executes the modified client from the affected device, the attacker could obtain code execution on the client system.

Recommendations For SICLOCK TC100, restrict access to port 69/udp to minimize the risk of exploitation. For SICLOCK TC400, restrict access to port 69/udp to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-4854

Affected Products

Siclock Tc100

Siclock Tc400

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-4854 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf · Vendor Advisory
• http://securityfocus.com/bid/104672 · Note