CVE-2025-47900

HighRCE

Published: 20 October 2025

Published

20 October 2025

Modified

31 March 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0039 60.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47900 is a high-severity OS Command Injection (CWE-78) vulnerability in Microchip Timeprovider 4100 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 39.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation of Remote Services (T1210) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates OS command injection by requiring validation and sanitization of untrusted inputs used in OS command construction.

SI-2 Flaw Remediation good match

prevent

Addresses the specific flaw in Time Provider 4100 prior to version 2.5 by mandating timely installation of vendor security patches.

AC-6 Least Privilege partial match

prevent

Limits the impact of successful command injection exploitation by enforcing least privilege on low-privilege (PR:L) accounts.

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

CVE enables remote exploitation of a network service for arbitrary OS command injection (T1210), directly facilitating Unix Shell command execution (T1059.004) on the affected embedded device.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

Deeper analysisAI

CVE-2025-47900 is an Improper Neutralization of Special Elements used in an OS Command, classified as an OS Command Injection vulnerability (CWE-78), affecting the Microchip Time Provider 4100. This issue impacts versions of Time Provider 4100 prior to 2.5. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An attacker requires low privileges (PR:L) to exploit this vulnerability over the network (AV:N) with low attack complexity and no user interaction. Successful exploitation allows arbitrary OS command injection, enabling high levels of impact on confidentiality, integrity, and availability (C:H/I:H/A:H) within the affected system.

Mitigation details are available in vendor-provided resources, including Microchip's guidance on the TimeProvider 4100 Grandmaster Remote Command Execution at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-command-execution and the TIM Red Team disclosure at https://www.gruppotim.it/en/footer/TIM-red-team.html. Updating to Time Provider 4100 version 2.5 or later addresses the issue.