PT-2025-30400 · Microchip · Timeprovider 4100+1

Andrea Sindoni + 8 · Published 2025-07-22 · Updated 2026-02-25 · CVE-2025-47904

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Microchip Time Provider 4100 versions prior to 2.5

Description A flaw exists in Microchip Time Provider 4100 that permits malicious manual software updates due to a missing integrity check during code download.

Recommendations Update to version 2.5 or later.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-47904

Affected Products

Timeprovider 4100

Timeprovider 4100 Firmware

References · 6

• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-unsigned-upgrade-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47904 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47904 · Vendor Advisory
• https://twitter.com/CVEnew/status/2026676454541623546 · Twitter Post
• https://gruppotim.it/en/footer/TIM-red-team.html · Note
• https://twitter.com/ntsuji/status/1947556888167793016 · Twitter Post