Man-in-the-middle attack in SICLOCK TC400 and SICLOCK TC100 - CVE-2018-4855
Published: July 5, 2018
Vulnerability identifier: #VU13571
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2018-4855
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Siemens
Affected software:
SICLOCK TC400
SICLOCK TC100
SICLOCK TC400
SICLOCK TC100
Detailed vulnerability description
The vulnerability allows a remote attacker to conduct man-in the-middle attack on the target system.
The weakness exists due to unencrypted storage of passwords in the client configuration files. A remote attacker in a privileged position, can intercept the communication between the affected device and the administrative client and obtain access passwords during network transmission.
How to mitigate CVE-2018-4855
Siemens has identified the following specific workarounds and mitigations that customers can apply to
reduce the risk:
• Provide redundant time sources and implement plausibility checks for the time information in critical
plant controllers.
• Protect network access to the affected devices with appropriate measures, e.g. protect SICLOCK
TC devices with firewalls to reduce the risk.
It is recommended to filter traffic to all ports excluding those needed for time synchronization. If
time synchronization is performed using NTP, then port 123/udp must be opened on the firewall. If
time synchronization is performed using SIMATIC time synchronization, then port 22223/udp and
port 22224/udp must be opened on the firewall.
For configuring parameters, it is recommended to use a direct connection to the SICLOCK TC.
• Apply the cell protection concept, and apply defense-in-depth: https://www.siemens.com/cert/
operational-guidelines-industrial-security
reduce the risk:
• Provide redundant time sources and implement plausibility checks for the time information in critical
plant controllers.
• Protect network access to the affected devices with appropriate measures, e.g. protect SICLOCK
TC devices with firewalls to reduce the risk.
It is recommended to filter traffic to all ports excluding those needed for time synchronization. If
time synchronization is performed using NTP, then port 123/udp must be opened on the firewall. If
time synchronization is performed using SIMATIC time synchronization, then port 22223/udp and
port 22224/udp must be opened on the firewall.
For configuring parameters, it is recommended to use a direct connection to the SICLOCK TC.
• Apply the cell protection concept, and apply defense-in-depth: https://www.siemens.com/cert/
operational-guidelines-industrial-security