{"id":"CVE-2025-47902","state":"PUBLISHED","title":"SQL Injection in web resource","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.","publishedAt":"2025-10-20T17:52:52.844Z","updatedAt":"2026-03-31T10:38:57.976Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","source":"Microchip"},"assigner":"Microchip","products":["Microchip Time Provider 4100"],"affected":[{"vendor":"Microchip","product":"Time Provider 4100","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.5","versionType":"semver"}]}],"references":["https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-sql-command-injection-47902","https://www.gruppotim.it/en/footer/TIM-red-team.html"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/47xxx/CVE-2025-47902.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-47902","state":"PUBLISHED","datePublished":"2025-10-20T17:52:52.844Z","dateUpdated":"2026-03-31T10:38:57.976Z","assignerShortName":"Microchip","assignerOrgId":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","dateReserved":"2025-05-13T19:24:53.452Z"},"containers":{"cna":{"title":"SQL Injection in web resource","descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5."}],"affected":[{"vendor":"Microchip","product":"Time Provider 4100","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.5","versionType":"semver"}]}],"references":[{"url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-sql-command-injection-47902","tags":["vendor-advisory"]},{"url":"https://www.gruppotim.it/en/footer/TIM-red-team.html","tags":["technical-description"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","baseScore":7.1,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Microchip","orgId":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","dateUpdated":"2026-03-31T10:38:57.976Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A user authenticated on the web interface on the separate management port."}],"value":"A user authenticated on the web interface on the separate management port."}],"credits":[{"lang":"en","type":"finder","value":"Dario Emilio Bertani"},{"lang":"en","type":"finder","value":"Raffaele Bova"},{"lang":"en","type":"finder","value":"Andrea Sindoni"},{"lang":"en","type":"finder","value":"Simone Bossi"},{"lang":"en","type":"finder","value":"Antonio Carriero"},{"lang":"en","type":"finder","value":"Marco Manieri"},{"lang":"en","type":"finder","value":"Vito Pistillo"},{"lang":"en","type":"finder","value":"Davide Renna"},{"lang":"en","type":"finder","value":"Manuel Leone"},{"lang":"en","type":"finder","value":"Massimiliano Brolli"},{"lang":"en","type":"reporter","value":"TIM Security Red Team Research (TIM S.p.A)"}],"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"source":{"advisory":"PSIRT-103","discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2025-04-15T07:00:00.000Z","value":"Reported"}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Do not expose the web interface on the separate management port to an \nuntrusted network. For added security, users have the option to disable \nthe web interface, further protecting the device from potential \nweb-based exploitations."}],"value":"Do not expose the web interface on the separate management port to an \nuntrusted network. For added security, users have the option to disable \nthe web interface, further protecting the device from potential \nweb-based exploitations."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-21T15:37:47.373652Z","id":"CVE-2025-47902","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T15:38:03.210Z"}}]}}}