CVE-2025-47900

8.9 high SSVC exploitation: none Modified

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

Fix

Patch, vendor advisory and mitigation references on NVD 1

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-command-execution Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-15 00:45First seenCVSS 8.9 · microchipNVD modified 2026-10-08 22:10

Affected (CPE criteria) 1

cpe:2.3:o:microchip:timeprovider_4100_firmware:*:*:*:*:*:*:*:*

References 2

https://www.gruppotim.it/en/footer/TIM-red-team.html
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-command-execution Vendor Advisory