ALBEDO Telecom Net.Time - PTP/NTP clock
Plan Patch8ICS-CERT ICSA-25-114-02Apr 24, 2025
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionRequired
Summary
The Net.Time PTP/NTP clock (Software v1.4.4, Serial No. NBC0081P) transmits administrative passwords over unencrypted connections, making them vulnerable to network interception. An attacker with network access and valid credentials could capture these passwords and gain unauthorized administrative access to reconfigure clock settings or manipulate time synchronization across connected control systems. ALBEDO Telecom has released firmware v1.6.1 to address this issue.
What this means
What could happen
An attacker with network access and valid user credentials could intercept unencrypted passwords transmitted by the Net.Time clock, potentially gaining unauthorized access to configure or manipulate time synchronization settings across networked infrastructure.
Who's at risk
Water utilities, electric utilities, and critical infrastructure operators who rely on PTP/NTP clock devices for synchronized timing across SCADA systems, protective relays, or network-attached devices. The Net.Time clock is commonly used in precision timing applications where time synchronization is critical for control system operation and event logging.
How it could be exploited
An attacker on the same network as the Net.Time device with valid login credentials sends a request that triggers password transmission over an unencrypted channel. A network sniffer positioned between the attacker and the device captures the plaintext password, which can then be reused for unauthorized administrative access.
Prerequisites
- Network access to the Net.Time device (same broadcast domain or routed network)
- Valid user account credentials for the Net.Time web interface or management protocol
- User interaction required (admin must log in or trigger a password-related action during attack window)
Remotely exploitable over networkRequires valid user credentials (reduces attack surface)Low complexity exploitationNo patch available for affected version 1.4.4 at time of advisory releaseAffects infrastructure timing—compromise could degrade synchronized operations
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (1)
ProductAffected VersionsFix Status
Net.Time - PTP/NTP clock (Serial No. NBC0081P): Software__1.4.4Software 1.4.4v1.6.1
Remediation & Mitigation
0/4
Do now
0/3HARDENINGIsolate the Net.Time device behind a firewall and restrict network access to only authorized management workstations
HARDENINGIf remote management is required, enforce access through a VPN with strong encryption
WORKAROUNDMonitor network traffic to the Net.Time device for suspicious activity or credential capture attempts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Net.Time firmware from v1.4.4 to v1.6.1 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/92305b25-cfb3-473f-9ddc-01d660806185