Timeprovider 4100 Firmware CVE-2025-47902

Real-world risk assessment presents a nuanced picture. The CVSS 4.0 score of 7.1 reflects serious impact potential with high integrity and availability consequences (VI:H, VA:H, SI:H, SA:H), affecting both the vulnerable system and supplementary components. However, several factors moderate immediate risk: the attack vector requires adjacent network access (AV:A) rather than remote internet exposure, the attacker needs low-level authenticated access (PR:L), and attack timing conditions must be present (AT:P). The EPSS score of 0.03% (9th percentile) indicates very low probability of exploitation in the wild based on historical data, and no public exploit identified at time of analysis. The vulnerability was reported through coordinated disclosure (TIM Red Team), suggesting responsible handling. Priority should be HIGH for organizations using TimeProvider 4100 in production environments due to the critical nature of time synchronization infrastructure, but immediate emergency response is not indicated by exploitation signals. Organizations should prioritize patching within standard change management windows, with accelerated timelines for internet-adjacent or high-sensitivity deployments.

An attacker with authenticated low-privilege access to the same network segment as the TimeProvider 4100 identifies SQL injection points in the device's web management interface or API endpoints. By crafting malicious SQL payloads in input fields or parameters, the attacker manipulates backend database queries to modify timing configuration parameters, extract sensitive network topology information, or disrupt time synchronization services. Successful exploitation could allow the attacker to alter time source priorities, inject false timing data affecting downstream network equipment, or cause denial of service by corrupting the device's configuration database. In telecommunications environments, compromised time synchronization can cascade to affect billing systems, call routing accuracy, and regulatory compliance with timing standards.