Lucene search

SiemensCVE-2018-4855

HistoryJul 03, 2018 - 2:29 p.m.

CVE-2018-4855

2018-07-0314:29:00

CWE-311

siemens

web.nvd.nist.gov

vulnerability

siclock

tc100

tc400

unencrypted storage

passwords

network transmission

attacker

privileged position

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). Unencrypted storage of passwords in the client configuration files and during network transmission could allow an attacker in a privileged position to obtain access passwords.

Affected configurations

Nvd

Node

siemenssiclock_tc400_firmwareMatch-

AND

siemenssiclock_tc400Match-

Node

siemenssiclock_tc100_firmwareMatch-

AND

siemenssiclock_tc100Match-

VendorProductVersionCPE
siemenssiclock_tc400_firmware-cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:*
siemenssiclock_tc400-cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:*
siemenssiclock_tc100_firmware-cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:*
siemenssiclock_tc100-cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	siclock_tc400_firmware	-	cpe:2.3:o:siemens:siclock_tc400_firmware:-:::::::*
siemens	siclock_tc400	-	cpe:2.3:h:siemens:siclock_tc400:-:::::::*
siemens	siclock_tc100_firmware	-	cpe:2.3:o:siemens:siclock_tc100_firmware:-:::::::*
siemens	siclock_tc100	-	cpe:2.3:h:siemens:siclock_tc100:-:::::::*

CNA Affected

[
  {
    "product": "SICLOCK TC100, SICLOCK TC400",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "SICLOCK TC100 : All versions"
      },
      {
        "status": "affected",
        "version": "SICLOCK TC400 : All versions"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104672

cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Related for CVE-2018-4855