Cyber Resilience

CVE-2025-47901

High

Published: 20 October 2025

Published
20 October 2025
Modified
31 March 2026
KEV Added
—
Patch
—
CVSS Score v4 8.9 CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0033 56.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47901 is a high-severity OS Command Injection (CWE-78) vulnerability in Microchip Timeprovider 4100 Firmware. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 43.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-47901 is an Improper Neutralization of Special Elements used in an OS Command, classified as an OS Command Injection vulnerability (CWE-78), affecting the Microchip Time Provider 4100. This issue impacts versions of the Time Provider 4100 prior to 2.5. The vulnerability was published on 2025-10-20 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables OS command injection, resulting in high impacts to confidentiality, integrity, and availability, potentially allowing full remote command execution on the affected device.

Microchip's security advisory for the Time Provider 4100 Grandmaster Remote Command Execution (CVE-2025-47901) addresses mitigation, with upgrading to version 2.5 or later resolving the issue. Additional references include the TIM Red Team disclosure page.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

CVE-2025-47901 is an OS command injection vulnerability in a network appliance (Time Provider 4100), allowing remote low-privileged attackers to achieve full RCE, directly facilitating T1210 (Exploitation of Remote Services) and T1059.008 (Network Device CLI).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-47900Same product: Microchip Timeprovider 4100
CVE-2025-56088Shared CWE-78
CVE-2025-56130Shared CWE-78
CVE-2026-3841Shared CWE-78
CVE-2025-8693Shared CWE-78
CVE-2025-56097Shared CWE-78
CVE-2025-56101Shared CWE-78
CVE-2025-37158Shared CWE-78
CVE-2025-56091Shared CWE-78
CVE-2024-5461Shared CWE-78

Affected Assets

microchip
timeprovider 4100 firmware
≤ 2.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and neutralization of special elements in inputs to prevent OS command injection as exploited in this CVE.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and patching of flaws like this OS command injection vulnerability, aligning with the vendor's upgrade to version 2.5.

SI-9 Information Input Restrictions partial match
prevent

Restricts information inputs to authorized types and characteristics, mitigating injection of malicious OS commands by limiting special elements.

References