Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

SICLOCK TC100 and TC400 admin can lock out users

CVE-2018-4856 · published 8 years ago
Summary

Both the SICLOCK TC100 and TC400 devices allow someone with administrative rights to the management web page to deliberately block legitimate users from accessing the system. This lockout requires a physical or manual reset to restore normal operation. Limit who has admin access, use strong authentication, and apply any firmware updates that address this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
siemens siclock_tc400_firmware All versions
cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:*
siemens siclock_tc100_firmware All versions
cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access to the device's management interface could lock out legi...
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access to the device's management interface could lock out legitimate users. Manual interaction is required to restore the access of legitimate users.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published3 Jul 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-4856 · NVD
Track software like this
Free during beta