PT-2026-28307 · Microchip · Microchip Timeprovider 4100

Andrea Sindoni + 8 · Published 2026-03-28 · Updated 2026-03-28 · CVE-2025-9497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microchip Time Provider 4100 versions prior to 2.5.0

Description A use of hard-coded credentials issue exists in Microchip Time Provider 4100, potentially allowing for malicious manual software updates.

Recommendations Update Microchip Time Provider 4100 to version 2.5.0 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-9497

Affected Products

Microchip Timeprovider 4100

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9497 · Security Note
• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-hardcoded-upgrade-decryption-passwords · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2037857265655349735 · Twitter Post
• https://twitter.com/CVEarity/status/2037945971846615508 · Twitter Post
• https://gruppotim.it/en/footer/TIM-red-team.html · Note