RCE in Microchip Time Provider 4100
CVE-2025-47901
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.003 (56.3th percentile) — read the EPSS interpretation.
Affected products
- Microchip Time Provider 4100 — versions 0
Weakness classification (CWE)
References
- www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-… (vendor-advisory)
- www.gruppotim.it/en/footer/TIM-red-team.html (technical-description)