CVE-2018-4853CWE-306

A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions)

published July 3, 2018

CVSS
—
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

🚨 A network access to port 69/udp is all it takes to modify the firmware of SICLOCK TC100 and TC400 devices!🔒 Think of it like a delivery driver who’s allowed to drop off packages but also has the key to change the entire lock on your front door. If they want to, they could swap the entire security system without you ever knowing! An attacker could take full control of the device, potentially leading to unauthorized firmware changes. This could disrupt operations, compromise security, or even make the device vulnerable to further attacks. The consequences of this could be absolutely devastating!

Put simply

Think of it like a delivery driver who’s allowed to drop off packages but also has the key to change the entire lock on your front door. If they want to, they could swap the entire security system without you ever knowing! This vulnerability allows an attacker with network access to port 69/udp to modify the firmware of the SICLOCK TC100 and TC400 devices. It means that a malicious party can send crafted firmware updates, leading to unauthorized control.

What to do

An attacker could take full control of the device, potentially leading to unauthorized firmware changes. This could disrupt operations, compromise security, or even make the device vulnerable to further attacks. The consequences of this could be absolutely devastating! Immediately restrict access to port 69/udp to trusted networks only. Monitor device logs for any suspicious firmware modifications and ensure your devices are running the latest firmware available from the manufacturer. 🛡️ You've got this! With these steps, you can secure your devices and keep your operations running smoothly. 🌟

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02267 · 82.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2018-07-03T14:00Z
EPSS history
Timeline
  • 03 JUL 14:00Z
    A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions)
    cvelistv5