PT-2024-30611 · Microchip · Microchip Timeprovider 4100

Antonio Carriero + 6 · Published 2024-10-04 · Updated 2025-08-29 · CVE-2024-43684

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microchip TimeProvider 4100 versions 1.0 and later

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability that also allows Cross-Site Scripting (XSS). This vulnerability affects the Microchip TimeProvider 4100, allowing for unauthorized actions to be performed on the device.

Recommendations For Microchip TimeProvider 4100 version 1.0 and later, update to a version that includes a fix for this issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating request origins and using anti-CSRF tokens. Restrict access to sensitive functionality to minimize the risk of exploitation.

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2024-43684

Affected Products

Microchip Timeprovider 4100

References · 11

• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-cross-site-request-forgery · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43684 · Security Note
• https://t.me/cvenotify/98586 · Telegram Post
• https://gruppotim.it/it/footer/red-team.html · Note
• https://twitter.com/CveFindCom/status/1842294366238368209 · Twitter Post
• https://t.me/cvenotify/97093 · Telegram Post
• https://t.me/cveNotify/133978 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842349369191764066 · Twitter Post
• https://t.me/cvedetector/7024 · Telegram Post
• https://twitter.com/CVEnew/status/1842298007515172996 · Twitter Post