Timeprovider 4100 Firmware CVE-2025-47900

This vulnerability affects the Microchip TimeProvider 4100 Grandmaster (firmware versions before 2.5), a precision network time protocol (NTP/PTP) appliance used in critical infrastructure and telecommunications for high-accuracy time synchronization. The flaw stems from CWE-78 (OS Command Injection), where the device fails to properly sanitize user-supplied input before passing it to system shell commands. Given the adjacent network attack vector (AV:A) in the CVSS 4.0 vector, the vulnerable interface is likely accessible via the device's management network rather than requiring direct physical access or internet exposure. Command injection vulnerabilities typically occur in web management interfaces, CLI handlers, or API endpoints that construct shell commands using concatenation or unsafe system() calls rather than parameterized execution. The CVSS vector indicates low attack complexity (AC:L) and requires only low privileges (PR:L), suggesting the vulnerability may be exploitable by any authenticated management user rather than requiring administrator-level access. The AT:P (Attack Requirements: Present) metric suggests specific preconditions must be met, possibly requiring the attacker to be on the same network segment or VLAN as the management interface.