PT-2024-30610 · Microchip · Timeprovider 4100

Antonio Carriero + 6 · Published 2024-10-04 · Updated 2024-11-01 · CVE-2024-43683

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions Microchip TimeProvider 4100 versions 1.0 and later

Description The issue is related to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability that allows XSS Through HTTP Headers. This can lead to security issues, as it enables malicious activities through HTTP headers.

Recommendations For Microchip TimeProvider 4100 versions 1.0 and later, consider disabling the HTTP header processing functionality until a patch is available. Restrict access to the affected system to minimize the risk of exploitation. Avoid using the vulnerable system for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-43683

Affected Products

Timeprovider 4100

References · 10

• https://osv.dev/vulnerability/CVE-2024-43683 · Vendor Advisory
• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-improper-verification-of-host-header · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43683 · Security Note
• https://t.me/cvenotify/97092 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842348088595304488 · Twitter Post
• https://gruppotim.it/it/footer/red-team.html · Note
• https://twitter.com/CVEnew/status/1842298006244397509 · Twitter Post
• https://twitter.com/CveFindCom/status/1842301566021243299 · Twitter Post
• https://t.me/cvedetector/7023 · Telegram Post
• https://t.me/cvenotify/98312 · Telegram Post