Devices: Industrial and Infrastructure

In brief: Factories, power grids, pipelines, fuel stations and telecom networks run on specialised computers (PLCs, SCADA servers, meters, relays) that are designed to run untouched for decades. Some of them count time in a way that breaks in January 2038. In 2025 the US cybersecurity agency CISA issued the first public advisories for this kind of bug, in fuel-tank monitoring systems, and showed that an attacker can set the clock forward today to crash or lock them.

Overview

Industrial control systems (ICS) and operational technology (OT) combine the worst traits described in Devices-and-Embedded-Systems: 15–30-year service lives, firmware that is rarely updated, long certification chains, and heavy dependence on accurate, shared time. Time in OT is not only for logs. It drives sequence-of-events recording in substations, alarm ordering in SCADA, billing in metering, scheduling in building automation, and authentication on device web interfaces.

The ITU-T technical paper on 2038-class events lists the industrial failure modes: "Legacy PLCs, SCADA endpoints, maritime, railway" and similar systems producing faults from out-of-range timestamps, and timestamp corruption affecting control-loop behaviour "in ways that trigger protective shutdowns" ^[1]. It notes that 32-bit time logic hides in compatibility layers, soft-PLCs, PLC drivers, vendor SDKs and API bridges, so replacing one visible box may not remove the problem ^[1].

The big change since 2024 is evidence. Bitsight's ICS lab reported that it could manipulate both NTP and GPS time to trigger 2038-related failures in real devices: crashes, corrupted logs and denial of access ^[2]. Two of those findings became CISA ICS advisories in 2025 ^[3][4].

Technical details

Confirmed vendor advisories

Both were reported by Pedro Umbelino of Bitsight ^[3][4]. Automatic tank gauges (ATGs) are a useful case study. Bitsight counts 5,000–10,000 exposed ATGs worldwide and cites the EPA figure of about 535,000 regulated tanks at about 192,000 facilities. It estimates that replacing roughly 50,000 vulnerable units would cost USD 1–1.8 billion and take 3–6 years ^[2].

As of 2026-10-21, no further CISA advisory that explicitly cites the 2038 rollover was found during research for this page. A Siemens forum thread refers to a SIMATIC panel "Product Note" whose relation to 2038 could not be confirmed (unverified).

Protocol time fields used in OT

Sector notes

• PLCs and SCADA. Many PLCs run proprietary RTOSes (see OS-Embedded-and-RTOS) or 32-bit embedded Linux. SCADA servers and historians are often Windows or 64-bit Linux and are usually safe at the OS level, but their drivers and protocol stacks may not be ^[1]. Historian databases that store epoch seconds in INT columns are covered on Databases.
• Power grid. Protection relays and substation gateways that implement IEC 61850 Edition 1 timestamps are exposed to the 2038 overflow at the protocol level ^[5]. The ITU-T paper flags electricity as a sector with "coherent-time dependency at the seconds-to-microseconds scale" and safety-critical certification regimes such as IEC 61850 and IEC 62443 ^[1].
• Smart meters. The DLMS/COSEM wire format carries a full year ^[9], so the protocol is not the limit. The risk is in meter firmware, data concentrators and head-end systems. No public 2038 advisory for a smart meter was found (as of 2026-10-21).
• Telecom. The ITU-T paper describes legacy DSLAMs, aggregation nodes and first-generation CPE that "often remain in service well beyond their original design horizon", plus carrier timing built on NTP, PTP (IEEE 1588) and GNSS. A failure in timing infrastructure "does not stay confined to telecommunications" ^[1].
• Building automation. HVAC controllers, elevators, door locks, alarms and lighting are named as at-risk OT/IoT classes by Kaspersky ^[10]. Field-level protocol limits for BACnet and KNX were not verified for this page.
• Fuel retail. See the ATG advisories above.

Affected versions / products

Risk & compliance notes

• Exploitable now. Because time can be spoofed (NTP injection, GPS spoofing), 2038 bugs are denial-of-service vulnerabilities today, not in 2038 ^[2][10]. Treat them in vulnerability management, not only in long-range planning.
• Correlated failure. The ITU-T paper warns that 2038-class failures can hit many sites at once, through shared time sources, which is unlike most OT incidents ^[1].
• Inventory owners. OT engineering, facilities and vendors' service organisations. Ask vendors specifically about time handling, protocol edition (IEC 61850 Ed. 1 vs Ed. 2), C library and kernel versions.
• Frameworks. ITU-T XSTP.EPOCH (2026) and the IEEE P4150 project provide terminology and readiness evidence structures but impose no requirements ^[1][12].

Detection & mitigation

1. Inventory devices, firmware versions and the time source each one uses (NTP server, GPS receiver, PTP grandmaster, manual).
2. Check vendor advisories (CISA ICS advisories, vendor PSIRTs) for "2038", "Unix time" or CWE-190 time issues.
3. On an isolated bench unit, advance the clock across 2038-01-19 03:14:07 UTC and also across 2036-02-07 (NTP) and 2038-11-20 (GPS week). Record behaviour. Do not test in production ^[10].
4. Harden time distribution: restrict which NTP servers devices accept, prefer authenticated time (NTS) where supported, use GNSS spoofing detection, and alert on large clock jumps.
5. Upgrade affected devices (for example MagLink LX4 ≥ 4.20.3) and plan replacement where no fix exists.
6. See Testing-and-Detection and Remediation-Guide.

See also

• Devices-and-Embedded-Systems
• Devices-Networking-and-IoT
• File-Formats-and-Protocols
• NTP-Era-2036 · GPS-Week-Rollover
• Known-2038-Incidents

References

1. ITU-T Technical Paper XSTP.EPOCH, "Global coordination requirements for 2038-class rollover events" (liaison to IETF), 2026-07-21 — industrial failure modes, telecom and energy sector analysis.
2. Pedro Umbelino, "Forward to the Past: The Y2K38 Problem Ahead" — Bitsight, 2026-01-18 — NTP/GPS manipulation in ICS lab; ATG and NTP exposure figures.
3. ICSA-25-261-07: Dover Fueling Solutions ProGauge MagLink LX4 Devices — CISA, 2025-09-18 — CVE-2025-55068 details and fixed versions.
4. ICSA-25-296-03: Veeder-Root TLS4B Automatic Tank Gauge System — CISA, 2025-10-23 — CVE-2025-55067, 2038 epoch rollover.
5. Karlheinz Schwarz, "IEC 61850 timestamp to overflow in 2038" — NettedAutomation blog, 2010-11-21 — Ed. 1 INT32 vs Ed. 2 INT32U.
6. TF6510 TwinCAT 3 IEC 61850 documentation — Beckhoff Infosys — IEC 61850 timestamp structure and 2106 example.
7. DNP3 driver documentation — Inductive Automation Ignition 8.3 — DNP3TIME is UTC milliseconds since 1970; required time base since 2008.
8. MODBUS Timestamp Implementation: Methods and Solutions — Industrial Monitor Direct — no native Modbus time type; 32-bit epoch in two registers (secondary source).
9. CosemDateTime — OpenMUC jDLMS Javadoc — DLMS/COSEM date-time encoding, year 0–0xFFFF. (Link dead as of 2026-10-21; no archived copy found. Claim unverified.)
10. Stan Kaminsky, "Epochalypse Now — or how to deal with Y2K38" — Kaspersky, 2026-01-19 — at-risk OT/IoT device classes; NTP/GPS attack vectors; testing advice.
11. Arnd Bergmann, "[GIT PULL] y2038: core, driver and file system changes" — LKML, 2020-01-29 — Linux 5.6 requirements for 32-bit systems.
12. IEEE P4150 — IEEE Standards Association — rollover readiness recommended practice (active PAR, 2026-06-04).