A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400…
Priority LOW 31CWE-311Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-311.
Summary
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). Unencrypted storage of passwords in the client configuration files and during network transmission could allow an attacker in a privileged position to obtain access passwords.
Why it matters now
EPSS 0.0101 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SICLOCK TC100, SICLOCK TC400 | SICLOCK TC100 : All versions; SICLOCK TC400 : All versions | — | No fix listed | CNA |
- SICLOCK TC100, SICLOCK TC400 VendorSiemens Affected SICLOCK TC100 : All versions; SICLOCK TC400 : All versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-4855
- 2026-10-03 Alias added: GHSA-5879-3vjc-222g
References
More Siemens Siclock Tc100 Firmware vulnerabilities
- TI-2018-03429 Authentication bypass in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0CRITICAL 9.8
- TI-2018-03430 Missing authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0CRITICAL 9.8
- TI-2018-03431 Missing authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0HIGH 8.8
- TI-2018-03428 Resource management flaw in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0HIGH 8.2
- TI-2018-03433 Improper authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0MEDIUM 4.9
Sources
- CVE-2018-4855 · CVE Program
- CVE-2018-4855 · NVD
- FIRST EPSS
- GHSA-5879-3vjc-222g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences