CVE search · CVE-2024-9054

CVE-2024-9054

high 8.5

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2024-10-04
Last changed: 2026-06-17
Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5
Weakness: CWE-78

Severity

Version	Score	Vector	Source
CVSS 4.0	high 8.5	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber`	dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Secondary
CVSS 3.1	high 8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`	nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

microchip · timeprovider_4100_firmware

References

https://www.gruppotim.it/it/footer/red-team.htmlExploitThird Party Advisory
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-rce-through-configuration-fileVendor Advisory

CVE-2024-9054

Details

Severity

Affected products

References