Timeprovider 4100 Firmware vulnerabilities | LiveThreat CVE Feed

Product

Timeprovider 4100 Firmware

by Microchip · last CVE Mar 28, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities12 In the news0 Timeline

Severity mix

Critical 2High 5Medium 5Low 0

Severity

All severities12 Critical2 High5 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Timeprovider 4100 Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-9497	9.8	0%	Mar 28	Hardcoded Upgrade Decryption Passwords Affected: before 2.5.0
CVE-2024-43685	9.8	0%	Oct 4	Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7 Affected: 1.0 before 2.4.7
CVE-2025-47902	8.8	0%	Oct 20	SQL Injection in web resource Affected: before 2.5
CVE-2025-47901	8.8	1%	Oct 20	RCE on restore configuration password Affected: before 2.5
CVE-2025-47900	8.8	1%	Oct 20	RCE on backup configuration password Affected: before 2.5
CVE-2024-9054	8.8	16%	Oct 4	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip… Affected: 1.0 before 2.4.7
CVE-2024-43684	8.8	0%	Oct 4	Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100:… Affected: 1.0 before 2.4.7
CVE-2024-7801	6.5	1%	Oct 4	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This… Affected: 1.0 before 2.4.7
CVE-2024-43687	6.1	1%	Oct 4	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site… Affected: 1.0 before 2.4.7
CVE-2024-43686	6.1	13%	Oct 4	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected… Affected: 1.0 before 2.4.7
CVE-2024-43683	6.1	0%	Oct 4	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0 Affected: 1.0 before 2.4.7
CVE-2025-47904	4.1	0%	Feb 24	Unsigned upgrade package Affected: before 2.5