Improper authentication in Siemens SICLOCK TC100, SICLOCK TC400
Priority LOW 25CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access to the device's management interface could lock out legitimate users. Manual interaction is required to restore the access of legitimate users.
Why it matters now
EPSS 0.01276 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SICLOCK TC100, SICLOCK TC400 | SICLOCK TC100 : All versions; SICLOCK TC400 : All versions | — | No fix listed | CNA |
- SICLOCK TC100, SICLOCK TC400 VendorSiemens Affected SICLOCK TC100 : All versions; SICLOCK TC400 : All versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:siclock_tc400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siclock_tc400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siclock_tc100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siclock_tc100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-4856
- 2026-10-03 Alias added: GHSA-vjcj-jj92-97vr
References
More Siemens Siclock Tc100 Firmware vulnerabilities
- TI-2018-03429 Authentication bypass in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0CRITICAL 9.8
- TI-2018-03430 Missing authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0CRITICAL 9.8
- TI-2018-03431 Missing authentication in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0HIGH 8.8
- TI-2018-03428 Resource management flaw in Siemens SICLOCK TC100, SICLOCK TC400 CVSS 3.0HIGH 8.2
- TI-2018-03432 A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400… CVSS 3.0MEDIUM 6.5
Sources
- CVE-2018-4856 · CVE Program
- CVE-2018-4856 · NVD
- FIRST EPSS
- GHSA-vjcj-jj92-97vr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences