Skip to content
OpenAdvisories

Vendor

Microchip

24 known vulnerabilities.

Products

TimeProvider 4100 7 Time Provider 4100 5 GridTime 3000 4 TimePictra 2 RN4870 1 MPLAB® Harmony 3 Core Module 1 AN1044 1 AN953 1 SW300052 1 SAME70 1 SAMS70 1 SAMV70 1 SAMV71 1 SAMG55 1 SAM4C 1 SAM4S 1 SAM4N 1 SAM4E 1 SAM3S 1 SAM3N 1 SAM3U 1 IStaX 1 SAMA5D4 1
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-89172

    Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

    Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.

    Microchip AN1044 SW300052 AN953
  • Medium 4.6
    CVE-2026-12620

    Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server

    The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

    Microchip GridTime 3000
  • Medium 5.3
    CVE-2026-12621

    Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server

    Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.

    Microchip GridTime 3000
  • Medium 5.3
    CVE-2026-12622

    Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server

    The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

    Microchip GridTime 3000
  • Medium 5.1
    CVE-2026-12619

    GridTime™ 3000 GNSS Time Server CSRF to XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

    Microchip GridTime 3000
  • Medium 5.5
    CVE-2025-9497

    Hardcoded Upgrade Decryption Passwords

    Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.

    Microchip Time Provider 4100
  • Medium 5.7
    CVE-2025-47904

    Unsigned upgrade package

    Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

    Microchip Time Provider 4100
  • Medium 4.3
    CVE-2024-29155

    Denial of service on Microchip RN4870 devices

    On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. A third party can inject a second PairReqNoInputNoOutput request just after a real one, cau…

    Microchip RN4870
  • Medium 5.4
    CVE-2024-43686 EPSS 13%

    Reflected XSS in TimeProvider 4100 chart component

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • Medium 6.3
    CVE-2024-7801 Public exploit

    SQL injection in get_chart_data in TimeProvider 4100

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • Medium 6.3
    CVE-2024-4760

    Voltage glitch during startup of the EEFC NVM controller can bypass the security bit

    A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

    Microchip SAM3S SAMV70 SAM3U