Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-4853: SICLOCK TC100 and TC400 firmware can be altered over network
CVE-2018-4853 · published 8 years ago
Summary
Both SICLOCK TC100 and TC400 devices allow anyone who can reach their port 69/udp to change the internal software. That could let an attacker install malicious code or stop the clocks from working correctly. Protect the devices by blocking or restricting traffic to that port, applying any vendor‑issued firmware updates, and monitoring network access.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| siemens | siclock_tc400_firmware |
All versions
cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* |
| siemens | siclock_tc100_firmware |
All versions
cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* |
Original advisory text
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to port 69/udp could modify the firmware of the device.
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to port 69/udp could modify the firmware of the device.
References
- http://www.securityfocus.com/bid/104672 Third Party Advisory VDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf Mitigation Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published3 Jul 2018
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-4853 · NVD
Track software like this
Free during beta