CVE-2025-9497
Hard-coded Credentials in Microchip Time Provider 4100 Enables Unauthorized Updates
Publication date: 2026-03-28
Last updated on: 2026-04-01
Assigner: Microchip Technology
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microchip | time_provider_4100 | to 2.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the use of hard-coded credentials in the Microchip Time Provider 4100 device. Specifically, versions before 2.5.0 contain embedded credentials that cannot be changed, which allows an attacker to perform a malicious manual software update on the device.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with high privileges and local access to the device to perform unauthorized manual software updates. This could lead to the installation of malicious software or firmware, potentially compromising the device's integrity, availability, or security.