Timeprovider 4100 Firmware CVE-2025-47900

Real-world risk is moderate to high for organizations deploying TimeProvider 4100 devices, particularly in telecommunications and financial services where precise time synchronization is mission-critical. The CVSS 4.0 base score of 8.9 reflects high impact across all security objectives (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), indicating complete system compromise potential. However, several factors moderate immediate risk: the adjacent network attack vector (AV:A) limits exposure to attackers already positioned on management networks, the low EPSS score (0.28%) suggests security researchers and threat actors have not prioritized this target, and no public exploit code exists. The requirement for low privileges (PR:L) means any compromised management account could be leveraged, increasing risk in environments with weak credential management. SSVC decision framework considerations: exploitation status is 'none' (no KEV listing, no public POC), technical impact is 'total' (arbitrary command execution leads to full system control), and automatable is 'yes' (once credentials are obtained, command injection is typically scriptable). The attack requirements present (AT:P) metric suggests exploitation may require specific network positioning or timing conditions. Organizations using TimeProvider 4100 in isolated management networks face lower immediate risk than those with broader network exposure, but the potential for lateral movement and disruption of time-critical services elevates this beyond a routine vulnerability.

An attacker who has compromised low-privilege credentials for a TimeProvider 4100 management interface (through phishing, credential stuffing, or lateral movement from another network device) positions themselves on the adjacent management network segment. They craft malicious input to a vulnerable web interface parameter or API endpoint, injecting shell metacharacters and commands such as semicolons, pipes, or backticks concatenated with system commands. The device executes these commands with the privileges of the underlying service, allowing the attacker to establish persistence through backdoor accounts, exfiltrate configuration data containing network topology and authentication secrets, or manipulate time distribution to create denial-of-service conditions in time-sensitive applications like financial trading systems or telecommunications networks. No public exploit code exists at time of analysis, but the low attack complexity suggests skilled attackers could develop exploits rapidly once details emerge.