Microchip

20 CVEs across 228 Microchip products. Browse Microchip vulnerabilities, severities, and proof-of-concept exploits.

Microchip products with known CVEs

ProductCVEs
Timeprovider 410012
Timeprovider 4100 Firmware12
Rn48709
Rn4870 Firmware8
Syncserver S1007
Syncserver S100 Firmware7
Syncserver S2007
Syncserver S200 Firmware7
Syncserver S2507
Syncserver S250 Firmware7
Syncserver S3007
Syncserver S300 Firmware7
Syncserver S3507
Syncserver S350 Firmware7
Timeprovider 41007
Bm705
Bm70 Firmware5
Bm715
Bm71 Firmware5
Bm785
Bm78 Firmware5
Bm835
Bm83 Firmware5
Pic Lightblue Explorer Demo5
Pic Lightblue Explorer Demo Firmware5
Rn48715
Rn4871 Firmware5
Time Provider 41005
Gridtime 30004
Gridtime 30004
Gridtime 3000 Firmware4
Is18704
Is1870 Firmware4
Is18714
Is1871 Firmware4
Atsama5d21c-Cu3
Atsama5d21c-Cu Firmware3
Atsama5d21c-Cur3
Atsama5d21c-Cur Firmware3
Atsama5d225c-D1m-Cur3
Atsama5d225c-D1m-Cur Firmware3
Atsama5d22c-Cn3
Atsama5d22c-Cn Firmware3
Atsama5d22c-Cnr3
Atsama5d22c-Cnr Firmware3
Atsama5d22c-Cu3
Atsama5d22c-Cu Firmware3
Atsama5d22c-Cur3
Atsama5d22c-Cur Firmware3
Atsama5d23c-Cn3
Microchip CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-12622Medium5.42026-06-19The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03…
CVE-2026-12621Medium5.42026-06-19Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridT…
CVE-2026-12620Medium6.52026-06-19The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1…
CVE-2026-12619Medium5.42026-06-19Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scriptin…
CVE-2026-2336High8.82026-04-16A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own…
CVE-2025-9497Critical9.82026-03-28Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: befo…
CVE-2026-3010Medium6.12026-02-28Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Infor…
CVE-2026-2844High7.52026-02-28Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra…
CVE-2025-47904Medium4.12026-02-24Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider…
CVE-2025-47902High8.82025-10-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This is…
CVE-2025-47901High8.82025-10-20Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Inje…
CVE-2025-47900High8.82025-10-20Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Inje…
CVE-2024-29155Medium4.32024-10-16On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing…
CVE-2024-9054High8.82024-10-04Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerab…
CVE-2024-7801Medium6.52024-10-04Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQ…
CVE-2024-43687Medium6.12024-10-04Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules…
CVE-2024-43686Medium6.12024-10-04Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) al…
CVE-2024-43685Critical9.82024-10-04Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 be…
CVE-2024-43684High8.82024-10-04Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects…
CVE-2024-43683Medium6.12024-10-04URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvide…
CVE-2024-7490Critical9.82024-08-08Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer…
CVE-2024-302122024-05-28If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte o…
CVE-2024-4760Medium6.32024-05-16A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allow…
CVE-2023-51438Critical10.02024-01-09A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions…
CVE-2024-22216Critical10.02024-01-08In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system mana…
CVE-2020-27636Critical9.12023-10-10In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.
CVE-2023-23588Medium6.22023-04-11A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows)…
CVE-2022-40022Critical9.82023-02-13Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
CVE-2022-45192Medium6.52023-02-08An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a cleartext encryption pa…
CVE-2022-45191Medium6.52023-02-08An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pair confirm message wi…
CVE-2022-45190Medium5.32023-02-08An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry in the legacy pairing of the device.
CVE-2022-40480Medium6.52023-02-08Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via…
CVE-2022-46403High8.62022-12-19The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.
CVE-2022-46402Medium6.52022-12-19The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values.
CVE-2022-46401Medium5.42022-12-19The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete.
CVE-2022-46400Medium5.42022-12-19The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairi…
CVE-2022-46399High7.52022-12-19The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.
CVE-2021-37605High7.52021-08-05In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Chec…
CVE-2021-37604High7.52021-08-05In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated…
CVE-2020-20950Medium5.92021-01-19Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow on…
CVE-2020-17441Critical9.12020-12-11An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 headers does not validate whether the IPv6 payload length field is equal to the actu…
CVE-2019-16128Medium6.82020-10-22Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).
CVE-2019-16129Medium6.82020-10-22Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).
CVE-2019-16127Critical9.12020-10-22Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow.
CVE-2020-12789High7.52020-09-14The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.
CVE-2020-12788High7.52020-09-14CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.
CVE-2020-12787High7.52020-09-14Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.
CVE-2020-9033Medium6.52020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authl…
CVE-2020-9032Medium6.52020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernl…
CVE-2020-9031Medium6.52020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemo…
CVE-2020-9030Medium6.52020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the s…
CVE-2020-9029Medium6.52020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messa…
CVE-2020-9028Medium6.12020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User C…
CVE-2020-9034High7.52020-02-17Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated crea…
CVE-2019-19195Medium6.52020-02-10The Bluetooth Low Energy implementation on Microchip Technology BluSDK Smart through 6.2 for ATSAMB11 devices does not properly restrict link-layer data length…
CVE-2019-15809Medium4.72019-10-03Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature gene…
CVE-2009-16742009-05-18Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code via a long .cof pathname in a [TOOL_SET…
CVE-2009-16082009-05-11Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute arbitrary code via a .MCP p…