ICSA-21-103-11: Siemens TIM 4R-IE Devices

CISA's summary

Summary: TIM 4R-IE devices contain multiple vulnerabilities in the integrated NTP component as listed below. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2015-5219 — CVE-2015-5219 · CWE-681

  The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

• CVE-2015-7705 — CVE-2015-7705 · CWE-20

  The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

• CVE-2015-7855 — CVE-2015-7855 · CWE-20

  The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.

• CVE-2015-7871 — CVE-2015-7871 · CWE-287

  Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.

• CVE-2015-7973 — CVE-2015-7973 · CWE-294

  NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.

• CVE-2015-7974 — CVE-2015-7974 · CWE-287

  NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

• CVE-2015-7977 — CVE-2015-7977 · CWE-476

  ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

• CVE-2015-7979 — CVE-2015-7979 · CWE-821

  NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.

• CVE-2015-8138 — CVE-2015-8138 · CWE-20

  NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.

• CVE-2016-1547 — CVE-2016-1547 · CWE-821

  An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.

• CVE-2016-1548 — CVE-2016-1548 · CWE-290

  An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.

• CVE-2016-1550 — CVE-2016-1550 · CWE-200

  An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.

• CVE-2016-4953 — CVE-2016-4953 · CWE-287

  ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.

• CVE-2016-4954 — CVE-2016-4954 · CWE-362

  The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

Acknowledgments, as the advisory lists them

• Siemens ProductCERT: reporting these vulnerabilities to CISA.

The advisory's legal notice

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.