PT-2024-30614 · Microchip · Timeprovider 4100

Antonio Carriero + 6 · Published 2024-10-04 · Updated 2024-10-16 · CVE-2024-43687

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/U:Green

Name of the Vulnerable Software and Affected Versions Microchip TimeProvider 4100 versions 1.0 through 2.4.6

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting (XSS). This security issue affects the banner config modules of the Microchip TimeProvider 4100, allowing Cross-Site Scripting (XSS).

Recommendations For versions 1.0 through 2.4.6, update to version 2.4.7 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43687

Affected Products

Timeprovider 4100

References · 11

• 🔥 https://exploit-db.com/exploits/52120 · Exploit
• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://osv.dev/vulnerability/CVE-2024-43687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43687 · Security Note
• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-stored-xss-vulnerability-in-banner · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1842342966674743680 · Twitter Post
• https://t.me/cvenotify/98364 · Telegram Post
• https://t.me/cvenotify/97365 · Telegram Post
• https://twitter.com/CVEnew/status/1842291451725521193 · Twitter Post
• https://t.me/cvedetector/7019 · Telegram Post
• https://t.me/cvenotify/97096 · Telegram Post