4.9med
CVE-2018-4856
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions).
Published 8 y ago · modified 4 mo ago · JSON
CVSS
4.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 70%
Public exploits
0
none known
Summary
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access to the device's management interface could lock out legitimate users. Manual interaction is required to restore the access of legitimate users.
Exploit prediction (EPSS)
1.28% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.9 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
Affected products
- Siemens AG SICLOCK TC100, SICLOCK TC400
Classification
- Weakness
- CWE-287 Improper Authentication
References
- securityfocus.com /bid/104672 · vdb-entry, x_refsource_BID, x_transferred
- cert-portal.siemens.com /productcert/pdf/ssa-197012.pdf · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-4856
- NVD: CVE-2018-4856
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.