Microchip vulnerabilities

CVE-2026-18349 High · 7.3 CWE-1247 Aug 24, 2026

SAMA5D44 Fault Injection Vulnerability

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.

CVE-2026-12622 Medium · 5.4 CWE-601 Jun 19, 2026

Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server

The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

CVE-2026-12621 Medium · 5.4 CWE-79 Jun 19, 2026

Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server

Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.

CVE-2026-12620 Medium · 6.5 CWE-200 Jun 19, 2026

Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

CVE-2026-12619 Medium · 5.4 CWE-79 Jun 19, 2026

GridTime™ 3000 GNSS Time Server CSRF to XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

CVE-2026-2336 High · 8.8 CWE-331 Apr 16, 2026

Weak webstax_auth Cookie Authentication Allows Privilege Escalation

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.

CVE-2025-9497 Critical · 9.8 CWE-798 Mar 28, 2026

Hardcoded Upgrade Decryption Passwords

Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.

CVE-2026-3010 Medium · 6.1 CWE-79 Feb 28, 2026

TimePictra Stored Cross-Site Scripting

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2.

CVE-2026-2844 High · 7.5 CWE-306 Feb 28, 2026

TimePictra Authentication Bypass Vulnerability

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.

CVE-2025-47904 Medium · 4.1 CWE-494 Feb 24, 2026

Unsigned upgrade package

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

CVE-2025-47902 High · 8.8 CWE-89 Oct 20, 2025

SQL Injection in web resource

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.

CVE-2025-47901 High · 8.8 CWE-78 Oct 20, 2025

RCE on restore configuration password

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

CVE-2025-47900 High · 8.8 CWE-78 Oct 20, 2025

RCE on backup configuration password

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.