PT-2025-42796 · Microchip · Microchip Timeprovider 4100

Andrea Sindoni + 8 · Published 2025-10-20 · Updated 2025-10-23 · CVE-2025-47901

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Microchip Time Provider 4100 versions prior to 2.5

Description An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Microchip Time Provider 4100. This allows for OS Command Injection. The issue relates to restoring the configuration password.

Recommendations Update Microchip Time Provider 4100 to version 2.5 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-47901

Affected Products

Microchip Timeprovider 4100

References · 8

• https://osv.dev/vulnerability/CVE-2025-47901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47901 · Security Note
• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-command-execution-47901 · Vendor Advisory
• https://twitter.com/SecAideInfo/status/1981303685042090055 · Twitter Post
• https://twitter.com/CveFindCom/status/1980335683265868175 · Twitter Post
• https://t.me/CVEtracker/35332 · Telegram Post
• https://gruppotim.it/en/footer/TIM-red-team.html · Note
• https://twitter.com/CVEnew/status/1980338984619274627 · Twitter Post