Microchip vulnerabilities
60 vulnerabilities
Known vulnerabilities in Microchip products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 130 products.
Products
50 of 130- Timeprovider 410012 vulnerabilities
- Rn48709 vulnerabilities
- Syncserver S1007 vulnerabilities
- Syncserver S2007 vulnerabilities
- Syncserver S2507 vulnerabilities
- Syncserver S3007 vulnerabilities
- Syncserver S3507 vulnerabilities
- Bm705 vulnerabilities
- Bm715 vulnerabilities
- Bm785 vulnerabilities
- Bm835 vulnerabilities
- Pic Lightblue Explorer Demo5 vulnerabilities
- Rn48715 vulnerabilities
- Time Provider 41005 vulnerabilities
- Gridtime 30004 vulnerabilities
- Is18704 vulnerabilities
- Is18714 vulnerabilities
- Atsama5D21C Cu3 vulnerabilities
- Atsama5D21C Cur3 vulnerabilities
- Atsama5D225C D1M Cur3 vulnerabilities
- Atsama5D22C Cn3 vulnerabilities
- Atsama5D22C Cnr3 vulnerabilities
- Atsama5D22C Cu3 vulnerabilities
- Atsama5D22C Cur3 vulnerabilities
- Atsama5D23C Cn3 vulnerabilities
- Atsama5D23C Cnr3 vulnerabilities
- Atsama5D23C Cu3 vulnerabilities
- Atsama5D23C Cur3 vulnerabilities
- Atsama5D24C Cu3 vulnerabilities
- Atsama5D24C Cuf3 vulnerabilities
- Atsama5D24C Cur3 vulnerabilities
- Atsama5D26C Cn3 vulnerabilities
- Atsama5D26C Cnr3 vulnerabilities
- Atsama5D26C Cu3 vulnerabilities
- Atsama5D26C Cur3 vulnerabilities
- Atsama5D27 Som13 vulnerabilities
- Atsama5D27 Wlsom13 vulnerabilities
- Atsama5D27C Cn3 vulnerabilities
- Atsama5D27C Cnr3 vulnerabilities
- Atsama5D27C Cnrvao3 vulnerabilities
- Atsama5D27C Cnvao3 vulnerabilities
- Atsama5D27C Cu3 vulnerabilities
- Atsama5D27C Cur3 vulnerabilities
- Atsama5D27C D1G Cu3 vulnerabilities
- Atsama5D27C D1G Cur3 vulnerabilities
- Atsama5D27C D5M Cu3 vulnerabilities
- Atsama5D27C D5M Cur3 vulnerabilities
- Atsama5D27C Ld1G Cu3 vulnerabilities
- Atsama5D27C Ld1G Cur3 vulnerabilities
- Atsama5D27C Ld2G Cu3 vulnerabilities
CVE-2021-37605microchipmiwi
EPSS score1.28%
In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check (MIC) bytes.CVE-2021-37604microchipmiwiEPSS score1.23%
In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated prior to the message authentication. With this vulnerability in place, an attacker may increment the incoming frame counter values by injecting messages with a sufficiently large frame counter value and invalid payload. This results in denial of service/valid packets in the network. There is also a possibility of a replay attack in the stack.CVE-2025-47902microchiptime provider 4100+1EPSS score0.38%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.CVE-2025-47901microchiptime provider 4100+1EPSS score1.38%
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.CVE-2025-47900microchiptime provider 4100+1EPSS score1.38%
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.CVE-2025-47904microchiptime provider 4100+1EPSS score0.10%
Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.CVE-2025-9497microchiptime provider 4100+1EPSS score0.32%
Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.CVE-2020-20950ietfpublic_key_cryptography_standards_\#1+1EPSS score0.88%
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.CVE-2020-9031microchipsyncserver_s100_firmware+4EPSS score1.06%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php.CVE-2020-9033microchipsyncserver_s100_firmware+4EPSS score1.35%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authlog.php.CVE-2020-9029microchipsyncserver_s100_firmware+4EPSS score1.22%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php.CVE-2020-9032microchipsyncserver_s100_firmware+4EPSS score1.06%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernlog.php.CVE-2020-9030microchipsyncserver_s100_firmware+4EPSS score1.06%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php.CVE-2020-9034microchipsyncserver_s100_firmware+4EPSS score0.91%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of users.CVE-2020-9028microchipsyncserver_s100_firmware+4EPSS score0.67%
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user).CVE-2020-17441altranpicotcp+1EPSS score7.00%
An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 headers does not validate whether the IPv6 payload length field is equal to the actual size of the payload, which leads to an Out-of-Bounds read during the ICMPv6 checksum calculation, resulting in either Denial-of-Service or Information Disclosure. This affects pico_ipv6_extension_headers and pico_checksum_adder (in pico_ipv6.c and pico_frame.c).CVE-2020-27636microchipmplab_network_creatorEPSS score0.87%
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.CVE-2020-12789microchipatsama5d21c-cu_firmware+75EPSS score1.23%
The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.CVE-2020-12788microchipatsama5d21c-cu_firmware+75EPSS score1.34%
CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.CVE-2020-12787microchipatsama5d21c-cu_firmware+75EPSS score1.23%
Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.