$ cve CVE-2024-9054 JSON

CVE-2024-9054 EXPLOIT

8.8

HIGH · CVSS 3.1 · EPSS 15.6% (pctl 97)

Patch early

A public exploit exists.

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Scoring

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	15.63% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	yes
Published	2024-10-04
Last modified	2026-06-17

Affected (2)

Vendor	Product
microchip	timeprovider 4100
microchip	timeprovider 4100 firmware

Public exploits

Source	Title	Date
exploit-db	Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection	2025-04-04

References

https://www.gruppotim.it/it/footer/red-team.html
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-rce-through-configuration-file

→ the Explorer · watch your stack · NVD