CVE-2024-9054CWE-78

Remote code Execution inTimeProvider® 4100

High · published October 4, 2024

CVSS v4.0

8.5

EPSS

16%

Percentile

96.8

In the wild

Unconfirmed

What it is

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

The record

Technical detail

CVSS v4.0: 8.5 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber
EPSS: 0.15626 · 96.8th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2024-10-04T19:42Z

EPSS history

Timeline

04 OCT 19:42Z
Remote code Execution inTimeProvider® 4100
cvelistv5