CVE Intelligence

Vulnerabilidades de Microchip

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Microchip: 14 registro(s), com severidade, exploração e correções.

Timeprovider 4100 Firmware 5Time Provider 4100 5Gridtime 3000 Firmware 4GridTime 3000 4Timepictra 2Istax 1SAMA5D4 1AN1044 1AN953 1SW300052 1

Somente exploradas (KEV) →

CVE-2026-89172 Média · 5.6 CWE-1300 12/09/2026
Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms
Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.
CVE-2026-18349 Alta · 7.3 CWE-1247 24/08/2026
SAMA5D44 Fault Injection Vulnerability
Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.
CVE-2026-12622 Média · 5.4 CWE-601 19/06/2026
Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server
The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
CVE-2026-12621 Média · 5.4 CWE-79 19/06/2026
Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server
Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.
CVE-2026-12620 Média · 6.5 CWE-200 19/06/2026
Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server
The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
CVE-2026-12619 Média · 5.4 CWE-79 19/06/2026
GridTime™ 3000 GNSS Time Server CSRF to XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
CVE-2026-2336 Alta · 8.8 CWE-331 16/04/2026
Weak webstax_auth Cookie Authentication Allows Privilege Escalation
A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.
CVE-2025-9497 Crítica · 9.8 CWE-798 28/03/2026
Hardcoded Upgrade Decryption Passwords
Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.
CVE-2026-3010 Média · 6.1 CWE-79 28/02/2026
TimePictra Stored Cross-Site Scripting
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2.
CVE-2026-2844 Alta · 7.5 CWE-306 28/02/2026
TimePictra Authentication Bypass Vulnerability
Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.
CVE-2025-47904 Média · 4.1 CWE-494 24/02/2026
Unsigned upgrade package
Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.
CVE-2025-47902 Alta · 8.8 CWE-89 20/10/2025
SQL Injection in web resource
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.
CVE-2025-47901 Alta · 8.8 CWE-78 20/10/2025
RCE on restore configuration password
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.
CVE-2025-47900 Alta · 8.8 CWE-78 20/10/2025
RCE on backup configuration password
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.