Microchip Vulnerabilities and Affected Products
Vulnerabilities associated with TimeProvider 4100.
Products
Clear product- TimeProvider 41007 vulnerabilities
- Time Provider 41005 vulnerabilities
- GridTime 30004 vulnerabilities
- timeprovider_4100_firmware4 vulnerabilities
- TimePictra2 vulnerabilities
- advanced_software_framework1 vulnerability
- IStaX1 vulnerability
- mplab_harmony1 vulnerability
- MPLAB® Harmony 3 Core Module1 vulnerability
- RN48701 vulnerability
- SAM3N1 vulnerability
- SAM3S1 vulnerability
- SAM3U1 vulnerability
- SAM4C1 vulnerability
- SAM4E1 vulnerability
- SAM4N1 vulnerability
- SAM4S1 vulnerability
- SAME701 vulnerability
- SAMG551 vulnerability
- SAMS701 vulnerability
- SAMV701 vulnerability
- SAMV711 vulnerability
- syncserver_s650_firmware1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-43683HIGH | Improper verification of the Host header in TimeProvider 4100URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0. CWE-601Oct 4, 2024 | CVSS8.7v4.0 | EPSS0.211% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-43684HIGH | Cross-Site Request Forgery vulnerability in TimeProvider 4100Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0. | CVSS8.7v4.0 | EPSS0.194% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-43685HIGH | Session token fixation in TimeProvider 4100Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. | CVSS8.7v4.0 | EPSS0.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-43686MEDIUM | Reflected XSS in TimeProvider 4100 chart componentImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. CWE-79Oct 4, 2024 | CVSS5.4v4.0 | EPSS11.5% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-9054HIGH | Remote code Execution inTimeProvider® 4100Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. | CVSS8.5v4.0 | EPSS15% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-43687HIGH | XSS vulnerability in bannerconfig endpoint in TimeProvider 4100Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7. CWE-79Oct 4, 2024 | CVSS7.7v4.0 | EPSS0.786% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-7801MEDIUM | SQL injection in get_chart_data in TimeProvider 4100Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. CWE-89Oct 4, 2024 | CVSS6.3v4.0 | EPSS0.843% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |