Which versions of Timeprovider 4100 Firmware are affected by CVE-2025-47902?

CVE-2025-47902 is a SQL injection vulnerability in Microchip TimeProvider 4100 Grandmaster devices running firmware versions below 2.5 that allows authenticated attackers with low privileges to…

How to fix or mitigate CVE-2025-47902?

Within 24 hours: Identify and inventory all Microchip TimeProvider 4100 Grandmaster devices and document current firmware versions. Within 7 days: Restrict network access to TimeProvider 4100 devices to trusted administrative users only; implement network segmentation to limit adjacent network access if feasible. Within 30 days: Contact Microchip for firmware 2.5 or later availability and security guidance; prepare upgrade testing plan in non-production environment; execute firmware upgrade to version 2.5+ on all affected devices following change management procedures.

Timeprovider 4100 Firmware CVE-2025-47902

Q: What is the CVSS score of CVE-2025-47902?

CVE-2025-47902 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

SQL Injection (CWE-89)

2025-10-20 dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

SQLi Timeprovider 4100 Firmware

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 31, 2026 - 11:37 vuln.today

CVE Published

Oct 20, 2025 - 18:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.

AnalysisAI

SQL injection in Microchip TimeProvider 4100 Grandmaster (firmware <2.5) allows adjacent network attackers with low-level privileges to achieve high integrity and availability impact across system and vulnerable components. EPSS exploitation probability is low (0.03%, 9th percentile) with no public exploit identified at time of analysis. Authentication requirements indicate PR:L (low privileges required) per CVSS vector. Attack complexity is low but requires present attack timing conditions (AT:P).

Technical ContextAI

This vulnerability affects the Microchip TimeProvider 4100 Grandmaster, a precision time synchronization appliance used in critical telecommunications and industrial infrastructure. The flaw stems from CWE-89 (SQL Injection), where user-supplied input is improperly sanitized before being incorporated into SQL queries. The CVSS 4.0 vector indicates adjacent network access (AV:A) is required, meaning attackers must be on the same network segment as the device. The CPE identifier cpe:2.3:o:microchip:timeprovider_4100_firmware confirms this is a firmware-level vulnerability in the device's operating system. SQL injection vulnerabilities in embedded timing infrastructure are particularly concerning as these devices often serve as authoritative time sources for entire network segments, and integrity compromise could cascade to dependent systems relying on accurate time synchronization.

RemediationAI

Upgrade Microchip TimeProvider 4100 firmware to version 2.5 or later, which addresses the SQL injection vulnerability. Obtain the patched firmware from Microchip's official security advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-sql-command-injection-47902. Follow vendor-provided upgrade procedures carefully as timing infrastructure requires careful change management to avoid service disruption. Until patching is completed, implement network segmentation to restrict adjacent network access to the TimeProvider 4100 management interfaces, enforce strong authentication for all administrative accounts (the vulnerability requires PR:L authenticated access), monitor SQL query logs for injection attempts, and apply principle of least privilege to limit which accounts can interact with database-backed management functions. Review and harden adjacent network access controls to ensure only authorized administrative systems can reach the device's management plane.