Read the docs

Microchip

Records60All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high19CVSS 7.0–8.9

Exploited now

Microchip records in CISA KEV

No Microchip vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Timeprovider 4100 Firmware 12 records MEDIUM Rn4870 Firmware 8 records MEDIUM Syncserver S100 Firmware 7 records LOW Syncserver S200 Firmware 7 records LOW Syncserver S250 Firmware 7 records LOW Syncserver S300 Firmware 7 records LOW Syncserver S350 Firmware 7 records LOW Bm70 Firmware 5 records MEDIUM

Records

12 records in Timeprovider 4100 Firmware · all components

TI-2024-08405 CVE-2024-9054 · GHSA-69rg-jv6m-76wg

Remote code Execution inTimeProvider® 4100

Priority MEDIUM 55

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules)…

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.15626 Published 2024-10-04 Fixed in 2.4.7 CWE-78
TI-2025-30306 CVE-2025-47901 · GHSA-6837-c8wf-6wp7

RCE on restore configuration password

Priority MEDIUM 43

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

CVSS 4.0HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.0138 Published 2025-10-20 Fixed in 2.5 CWE-78
TI-2025-30305 CVE-2025-47900 · GHSA-v89w-3c42-rprg

RCE on backup configuration password

Priority MEDIUM 43

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

CVSS 4.0HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.0138 Published 2025-10-20 Fixed in 2.5 CWE-78
TI-2024-29288 CVE-2024-43685 · GHSA-mwp3-45p3-xq9x

Session token fixation in TimeProvider 4100

Priority MEDIUM 40

Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.0044 Published 2024-10-04 Fixed in 2.4.7 CWE-613
TI-2024-29289 CVE-2024-43686 · GHSA-mf33-2wpg-fv43

Reflected XSS in TimeProvider 4100 chart component

Priority LOW 39

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from…

CVSS 4.0MEDIUM 5.4 Adjacent network Low privileges User interaction EPSS 0.12987 Published 2024-10-04 Fixed in 2.4.7 CWE-79
TI-2024-29287 CVE-2024-43684 · GHSA-xr9g-f9v2-9m3h

Cross-Site Request Forgery vulnerability in TimeProvider 4100

Priority LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00207 Published 2024-10-04 No fix listed CWE-352
TI-2024-29286 CVE-2024-43683 · GHSA-x22r-xgr5-23hh

Improper verification of the Host header in TimeProvider 4100

Priority LOW 39

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00226 Published 2024-10-04 Fixed in 2.4.7 CWE-601
TI-2024-29290 CVE-2024-43687 · GHSA-r25f-mfgv-vq97

XSS vulnerability in bannerconfig endpoint in TimeProvider 4100

Priority LOW 35

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimePr…

CVSS 4.0HIGH 7.7 Adjacent network No auth No interaction EPSS 0.00833 Published 2024-10-04 Fixed in 2.4.7, 2.5 CWE-79
TI-2025-30307 CVE-2025-47902 · GHSA-3q9q-g98g-m25j

SQL Injection in web resource

Priority LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.

CVSS 4.0HIGH 7.1 Adjacent network Low privileges No interaction EPSS 0.00378 Published 2025-10-20 Fixed in 2.5 CWE-89
TI-2025-08703 CVE-2025-9497 · GHSA-gv5m-4fg8-r764

Hardcoded Upgrade Decryption Passwords

Priority LOW 33

Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.

CVSS 4.0MEDIUM 5.5 Local High privileges No interaction EPSS 0.00329 Published 2026-03-28 Fixed in 2.5.0 CWE-798
TI-2024-07232 CVE-2024-7801 · GHSA-hmr6-x7h8-r5mp

SQL injection in get_chart_data in TimeProvider 4100

Priority LOW 30

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 be…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00843 Published 2024-10-04 Fixed in 2.4.7 CWE-89
TI-2025-30308 CVE-2025-47904 · GHSA-9wv6-vw4x-jjg6

Unsigned upgrade package

Priority LOW 24

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

CVSS 4.0MEDIUM 5.7 Local High privileges No interaction EPSS 0.00096 Published 2026-02-24 Fixed in 2.5 CWE-494
Open these records in search →