Skip to content
OpenAdvisories
Critical SSA-497656 14 CVEs

SSA-497656: Multiple NTP Vulnerabilities in TIM 4R-IE Devices

Published Apr 13, 2021 · Updated Jun 10, 2025 · Revision 2

Vendor: Siemens Product: SIPLUS NET TIM 4R-IE (6AG1800-4BA00-7AA0) Product: SIPLUS NET TIM 4R-IE DNP3 (6AG1803-4BA00-7AA0) Product: TIM 4R-IE (6NH7800-4BA00) Product: TIM 4R-IE DNP3 (6NH7803-4BA00-0AA0)

Summary

TIM 4R-IE devices contain multiple vulnerabilities in the integrated NTP component as listed below.

Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 14

  • Unscored —
    CVE-2015-5219

    The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision valu…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7705 EPSS 12%

    The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7855 Public exploit EPSS 31%

    The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7871 Public exploit EPSS 82%

    Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authe…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7973

    NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to co…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7974

    NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating pa…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7977

    ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer d…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7979 EPSS 12%

    NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server associat…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-8138

    NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a pack…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-1547

    An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec…

    NTPsec NTP Project ntpsec NTP Debian Ubuntu
  • Unscored —
    CVE-2016-1548

    An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timest…

    NTPsec NTP Project ntpsec NTP Debian Ubuntu
  • Unscored —
    CVE-2016-1550

    An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5f…

    NTPsec NTP Project ntpsec NTP Debian Ubuntu
  • Unscored —
    CVE-2016-4953 EPSS 17%

    ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilizati…

    ntp Debian
  • Unscored —
    CVE-2016-4954 EPSS 13%

    The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial …

    ntp ntp Debian Ubuntu

Revision history

  1. #2

    Expanded affected TIM 4R-IE product families to individual products, incl. MLFB IDs; CVE-2015-5219: changed CWE from CWE-704 to CWE-681; CVE-2015-7973: changed CWE from CWE-254 to CWE-294; CVE-2015-7979: changed CWE from CWE-19 to CWE-821; CVE-2016-1547: changed CWE from CWE-20 to CWE-821; CVE-2016-1548: changed CWE from CWE-19 to CWE-290

  2. #1

    Publication Date

References