CVE-2025-9497
Received Received - Intake
Hard-coded Credentials in Microchip Time Provider 4100 Enables Unauthorized Updates

Publication date: 2026-03-28

Last updated on: 2026-04-01

Assigner: Microchip Technology

Description
Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-28
Last Modified
2026-04-01
Generated
2026-06-16
AI Q&A
2026-03-28
EPSS Evaluated
2026-06-15
NVD
CVE-2025-9497
EUVD
EUVD-2025-209112
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
microchip time_provider_4100 to 2.5.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves the use of hard-coded credentials in the Microchip Time Provider 4100 device. Specifically, versions before 2.5.0 contain embedded credentials that cannot be changed, which allows an attacker to perform a malicious manual software update on the device.

Impact Analysis

The vulnerability can allow an attacker with high privileges and local access to the device to perform unauthorized manual software updates. This could lead to the installation of malicious software or firmware, potentially compromising the device's integrity, availability, or security.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart