CVE-2025-47901
Published: 20 October 2025
Description
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Security Summary
CVE-2025-47901 is an Improper Neutralization of Special Elements used in an OS Command, classified as an OS Command Injection vulnerability (CWE-78), affecting the Microchip Time Provider 4100. This issue impacts versions of the Time Provider 4100 prior to 2.5. The vulnerability was published on 2025-10-20 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables OS command injection, resulting in high impacts to confidentiality, integrity, and availability, potentially allowing full remote command execution on the affected device.
Microchip's security advisory for the Time Provider 4100 Grandmaster Remote Command Execution (CVE-2025-47901) addresses mitigation, with upgrading to version 2.5 or later resolving the issue. Additional references include the TIM Red Team disclosure page.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE-2025-47901 is an OS command injection vulnerability in a network appliance (Time Provider 4100), allowing remote low-privileged attackers to achieve full RCE, directly facilitating T1210 (Exploitation of Remote Services) and T1059.008 (Network Device CLI).