Time Provider 4100 CVE-2025-9497

Despite the absence of a CVSS score or vector in the available data, this vulnerability represents a critical security risk for organizations relying on Time Provider 4100 devices. The use of hard-coded credentials for cryptographic functions is a foundational authentication bypass that allows attackers to impersonate legitimate update sources. The real-world impact depends on network topology and access controls: if Time Provider 4100 devices are exposed to untrusted networks or if attackers gain local access, exploitation is trivial and requires no special technical sophistication. The authentication bypass classification indicates a high technical impact-an attacker can alter the device firmware and behavior without any legitimate authorization. No CVSS vector or EPSS score is provided, and no KEV status or public exploit code is documented in the input data, suggesting this vulnerability may be relatively recent or still under coordinated disclosure. However, the simplicity of the attack (leveraging known hard-coded credentials) and the critical nature of time synchronization infrastructure in financial, telecommunications, and power systems elevates the practical risk substantially.

An attacker on the same network segment as a Microchip Time Provider 4100 device intercepts or performs a manual firmware update operation. Using the hard-coded decryption credentials, the attacker crafts a malicious firmware image, encrypts it with the known credentials, and supplies it to the device update interface. The device accepts the update as legitimate because it successfully decrypts using the hard-coded key, allowing the attacker to install tampered firmware that alters time distribution across the network. This could disrupt timestamp-dependent systems, facilitate certificate validation bypasses, or compromise audit log integrity in downstream systems relying on accurate time from this provider.