Lucene search

SiemensCVE-2018-4851

HistoryJul 03, 2018 - 2:29 p.m.

CVE-2018-4851

2018-07-0314:29:00

CWE-20

CWE-399

siemens

web.nvd.nist.gov

cve-2018-4851

siclock tc100

siclock tc400

denial-of-service

nvd

network access

time synchronization

gps

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of the device could be impacted. The time serving functionality recovers when time synchronization with GPS devices or other NTP servers are completed.

Affected configurations

Nvd

Node

siemenssiclock_tc400_firmwareMatch-

AND

siemenssiclock_tc400Match-

Node

siemenssiclock_tc100_firmwareMatch-

AND

siemenssiclock_tc100Match-

VendorProductVersionCPE
siemenssiclock_tc400_firmware-cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:*
siemenssiclock_tc400-cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:*
siemenssiclock_tc100_firmware-cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:*
siemenssiclock_tc100-cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	siclock_tc400_firmware	-	cpe:2.3:o:siemens:siclock_tc400_firmware:-:::::::*
siemens	siclock_tc400	-	cpe:2.3:h:siemens:siclock_tc400:-:::::::*
siemens	siclock_tc100_firmware	-	cpe:2.3:o:siemens:siclock_tc100_firmware:-:::::::*
siemens	siclock_tc100	-	cpe:2.3:h:siemens:siclock_tc100:-:::::::*

CNA Affected

[
  {
    "product": "SICLOCK TC100, SICLOCK TC400",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "SICLOCK TC100 : All versions"
      },
      {
        "status": "affected",
        "version": "SICLOCK TC400 : All versions"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104672

cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

Related for CVE-2018-4851