ByteOS Network

Vulnerability Details :

CVE-2025-47904

Assigner Org ID-dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Published At-24 Feb, 2026 | 15:34

Updated At-24 Feb, 2026 | 15:34

Unsigned upgrade package

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Microchip

Assigner Org ID:dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Published At:24 Feb, 2026 | 15:34

Updated At:24 Feb, 2026 | 15:34

▼CVE Numbering Authority (CNA)

Unsigned upgrade package

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

Affected Products

Vendor

Microchip

Product

Time Provider 4100

Default Status

unaffected

Versions

Affected

From 0 before 2.5 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-494	CWE-494 Download of Code Without Integrity Check

Type: CWE

CWE ID: CWE-494

Description: CWE-494 Download of Code Without Integrity Check

Metrics

Version	Base score	Base severity	Vector
4.0	5.7	MEDIUM	CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Version: 4.0

Base score: 5.7

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Impacts

CAPEC ID	Description
CAPEC-533	CAPEC-533 Malicious Manual Software Update

CAPEC ID: CAPEC-533

Description: CAPEC-533 Malicious Manual Software Update

Configurations

User knowledge of the decryption passwords and upgrade package structure.

Workarounds

Upgrades are only available on a separate management port which should not be connected to an untrusted network. ACLs are available to further restrict access to only trusted addresses.

Credits

finder

Dario Emilio Bertani

finder

Raffaele Bova

finder

Andrea Sindoni

finder

Simone Bossi

finder

Antonio Carriero

finder

Marco Manieri

finder

Vito Pistillo

finder

Davide Renna

finder

Manuel Leone

finder

Massimiliano Brolli

reporter

TIM Security Red Team Research (TIM S.p.A)

Timeline

Event	Date
Reported	2025-04-14 22:00:00

Event: Reported

Date: 2025-04-14 22:00:00

References

Hyperlink	Resource
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-unsigned-upgrade-vulnerability	vendor-advisory

Hyperlink: https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-unsigned-upgrade-vulnerability

Resource:

vendor-advisory

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Published At:24 Feb, 2026 | 16:24

Updated At:24 Feb, 2026 | 21:52

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	5.7	MEDIUM	CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Secondary

Version: 4.0

Base score: 5.7

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE ID	Type	Source
CWE-494	Secondary	dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

CWE ID: CWE-494

Type: Secondary

Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

References

Hyperlink	Source	Resource
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-unsigned-upgrade-vulnerability	dc3f6da9-85b5-4a73-84a2-2ec90b40fca5	N/A

Hyperlink: https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-unsigned-upgrade-vulnerability

Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Resource: N/A

CVE-2025-47904

Credits

Unsigned upgrade package

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs