Security Experts:

Connect with us

Hi, what are you looking for?



Flaws Expose Siemens Central Plant Clocks to Attacks

Siemens informed customers on Tuesday that some of its SICLOCK central plant clocks are affected by several vulnerabilities, including ones that have been rated “critical.”

Siemens informed customers on Tuesday that some of its SICLOCK central plant clocks are affected by several vulnerabilities, including ones that have been rated “critical.”

Siemens SICLOCK devices are used to synchronize time in industrial plants. The central plant clock ensures stability in case of a failure or loss of reception at the primary time source.

According to the German industrial giant, SICLOCK systems are affected by a total of six vulnerabilities. The security holes have been assigned the CVE identifiers CVE-2018-4851 through CVE-2018-4856.

Siemens SICLOCK vulnerabilities

Three of the flaws have been classified as critical. One of them allows an attacker with access to the network to cause the targeted device to enter a denial-of-service (DoS) condition – and possibly reboot – by sending it specially crafted packets.

“The core functionality of the device could be impacted. The time serving functionality recovers when time synchronization with GPS devices or other NTP servers are completed,” Siemens wrote in its advisory. “The vulnerability could impact the availability of the device, and could impact the integrity of the time service functionality of the device.”

Another critical vulnerability can be exploited by an attacker with access to UDP port 69 to modify the firmware on a targeted SICLOCK device. Access to the same port is also required for the exploitation of a different critical flaw that allows an attacker to modify the administrative client stored on the device and execute arbitrary code.

A high severity flaw disclosed by Siemens can allow a network attacker to bypass authentication, but exploitation requires the hacker to obtain specific information about the targeted device.

Register for SecurityWeek’s 2018 ICS Cyber Security Conference

The remaining security holes are a medium severity issue that allows a man-in-the-middle (MitM) attacker to intercept unencrypted passwords stored in client configuration files, and a low severity bug that can be exploited by an attacker with admin access to the management interface to lock out legitimate users.

Four of the six vulnerabilities can be exploited without any user interaction. Siemens says it’s not aware of any instances where these flaws have been exploited for malicious purposes.

The impacted products are SICLOCK TC100, which is designed for smaller plants, and SICLOCK TC400. Since both products are in the process of being phased out, Siemens has not released any firmware updates, and instead advised customers to apply a series of workarounds and mitigations that should reduce the risk of attacks.

Mitigations include the installation of redundant time sources and implementation of plausibility checks for critical controllers in the plant, and protecting network access to impacted devices.

Related: Siemens Patches Vulnerabilities in SCALANCE, Other Devices

Related: Severe DoS Flaw Discovered in Siemens SIMATIC PLCs

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.