CVE-2024-9054

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

CVSS v4.0

8.5 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

15.63% chance of exploitation in the next 30 days, 97th percentile

Published

2024-10-04

Updated

2025-08-29

Proof-of-concept exploits (1)

• https://www.gruppotim.it/it/footer/red-team.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52119

References

• CVE Record
• NVD entry

Related

• CVE-2024-9048
• CVE-2024-9061
• CVE-2024-9047
• CVE-2024-9076
• CVE-2024-9041
• CVE-2024-9077