Read the docs
TI-2024-08405 Aliases CVE-2024-9054GHSA-69rg-jv6m-76wg

Remote code Execution inTimeProvider® 4100

Priority MEDIUM 55CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15626 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed TimeProvider 4100 (Microchip): 2.4.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrochipTimeProvider 41001.0 to before 2.4.72.4.7Patch availableCNA
  • TimeProvider 4100 VendorMicrochip Affected 1.0 to before 2.4.7 Fixed in 2.4.7 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:microchip:timeprovider_4100_firmware:*:*:*:*:*:*:*:*1.0 to before 2.4.7VulnerableMicrochip
cpe:2.3:h:microchip:timeprovider_4100:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrochip
  • cpe:2.3:o:microchip:timeprovider_4100_firmware:*:*:*:*:*:*:*:* Versions 1.0 to before 2.4.7 Vulnerable ·Microchip
  • cpe:2.3:h:microchip:timeprovider_4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microchip

Remediation

  • Fix · CNA TimeProvider 4100 (Microchip) Fixed in 2.4.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Microchip TimeProvider 4100 2.4.7

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2024-29288 Session token fixation in TimeProvider 4100Priority MEDIUM 40
    • TI-2024-29289 Reflected XSS in TimeProvider 4100 chart componentPriority LOW 39
    • TI-2024-29286 Improper verification of the Host header in TimeProvider 4100Priority LOW 39
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-9054
  2. 2026-10-03 Alias added: GHSA-69rg-jv6m-76wg

References

Exploit 1

Advisory 1

  • TI-2025-30306 RCE on restore configuration password CVSS 4.0HIGH 8.9
  • TI-2025-30305 RCE on backup configuration password CVSS 4.0HIGH 8.9
  • TI-2024-29288 Session token fixation in TimeProvider 4100 CVSS 4.0HIGH 8.7
  • TI-2024-29289 Reflected XSS in TimeProvider 4100 chart component CVSS 4.0MEDIUM 5.4
  • TI-2024-29287 Cross-Site Request Forgery vulnerability in TimeProvider 4100 CVSS 4.0HIGH 8.7
  • TI-2024-29286 Improper verification of the Host header in TimeProvider 4100 CVSS 4.0HIGH 8.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences