CVE-2024-9054

Deeper analysis

CVE-2024-9054 is an OS command injection vulnerability, also involving exposure of sensitive information, that affects the configuration modules of the Microchip TimeProvider 4100 grandmaster clock. The flaw stems from improper neutralization of special elements in OS commands (CWE-78) and impacts all versions from 1.0 up to but not including 2.4.7. It carries a CVSS 4.0 score of 8.5, reflecting network attack vectors with low complexity and low privileges required.

An attacker with limited privileges and the ability to supply or modify configuration files can inject arbitrary operating system commands. Successful exploitation grants the ability to execute commands on the device, potentially leading to full control over the affected TimeProvider 4100 unit and disclosure of sensitive configuration or operational data.

Vendor guidance indicates that the issue is resolved in firmware version 2.4.7 and later. Microchip has published details on responsible disclosure for this remote code execution path through configuration files, while independent analysis from Gruppo TIM's red team highlights the practical impact on deployed appliances. The associated EPSS score reached a peak of 0.3259 before receding to its current value of 0.2457.