$ cve CVE-2024-7801 JSON

CVE-2024-7801 EXPLOIT

6.5

MEDIUM · CVSS 3.1 · EPSS 0.8% (pctl 57)

Patch early

A public exploit exists.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Scoring

CVSS	6.5 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	0.84% — more likely to be exploited than 57% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2024-10-04
Last modified	2026-06-17

Affected (2)

Vendor	Product
microchip	timeprovider 4100
microchip	timeprovider 4100 firmware

Public exploits

Source	Title	Date
exploit-db	Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection	2025-04-05

References

https://www.gruppotim.it/it/footer/red-team.html
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-unathenticated-sql-injection

→ the Explorer · watch your stack · NVD