CVE-2018-4851

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of the device could be impacted. The time serving functionality recovers when time synchronization with GPS devices or other NTP servers are completed.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-399 CWE-20

Affected software

Vendor	Product	Versions
Siemens AG	SICLOCK TC100, SICLOCK TC400	SICLOCK TC100 : All versions; SICLOCK TC400 : All versions

References

http://www.securityfocus.com/bid/104672Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdfMitigation, Vendor Advisory
http://www.securityfocus.com/bid/104672Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdfMitigation, Vendor Advisory

Timeline

Published: Jul 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-48529.8A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the CVE-2018-48539.8A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to por CVE-2018-48548.8A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to por CVE-2018-48556.5A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). Unencrypted storage of passwords in th CVE-2018-48564.9A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access CVE-2018-48587.8A vulnerability has been identified in IEC 61850 system configurator (All versions < V5.80), DIGSI 5 (affected as IEC 61850 system configura CVE-2018-48597.2A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/CVE-2018-48607.2A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/CVE-2018-48614.9A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/CVE-2018-48628.8In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure accou CVE-2018-48635.5Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYST CVE-2018-48685.5The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive mem