VulnerabilityModified

CVE-2025-47904

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

MEDIUM 5.7EPSS 0.09%

Does this matter?

Lower severity and a low EPSS score (0.09%). Track it; it rarely justifies an emergency change on its own.

Description

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

CVSS 4.0: 5.7 MEDIUMCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.09% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-494
Affected: microchip/timeprovider 4100 firmware
Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

References

https://www.gruppotim.it/en/footer/TIM-red-team.html
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-unsigned-upgrade-vulnerabilityVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.