Resource management flaw in Siemens SICLOCK TC100, SICLOCK TC400
Priority LOW 39CWE-399Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of the device could be impacted. The time serving functionality recovers when time synchronization with GPS devices or other NTP servers are completed.
Why it matters now
EPSS 0.01455 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SICLOCK TC100, SICLOCK TC400 | SICLOCK TC100 : All versions; SICLOCK TC400 : All versions | — | No fix listed | CNA |
- SICLOCK TC100, SICLOCK TC400 VendorSiemens Affected SICLOCK TC100 : All versions; SICLOCK TC400 : All versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-4851
- 2026-10-03 Alias added: GHSA-x4qq-cpcc-jfwx
References
More Siemens Siclock Tc100 Firmware vulnerabilities
- TI-2018-03429 Authentication bypass in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0CRITICAL 9.8
- TI-2018-03430 Missing authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0CRITICAL 9.8
- TI-2018-03431 Missing authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0HIGH 8.8
- TI-2018-03432 A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400… CVSS 3.0MEDIUM 6.5
- TI-2018-03433 Improper authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0MEDIUM 4.9
Sources
- CVE-2018-4851 · CVE Program
- CVE-2018-4851 · NVD
- FIRST EPSS
- GHSA-x4qq-cpcc-jfwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences