CVE-2024-9054

CVSS V2 None CVSS V3 None

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Overview

CVE ID
CVE-2024-9054

Assigner
Microchip

Vulnerability Status
PUBLISHED

Published Version
2024-10-04T19:42:44.129Z

Last Modified Date
2024-10-04T22:16:03.570Z

Weakness Enumerations

CWE	URL
CWE-78	http://cwe.mitre.org/data/definitions/78.html
CWE-200	http://cwe.mitre.org/data/definitions/200.html

References

Reference URL	Reference Tags
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-rce-through-configuration-file	vendor-advisory
https://www.gruppotim.it/it/footer/red-team.html	third-party-advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-9054
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9054

History

Created	Old Value	New Value	Data Type	Notes
2024-10-07 04:04:35				Added to TrackCVE