Medium severity6.1NVD Advisory· Published Oct 4, 2024· Updated Jun 17, 2026

CVE-2024-43686

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Microchip/Timeprovider 4100 Firmware
cpe:2.3:o:microchip:timeprovider_4100_firmware:*:*:*:*:*:*:*:*
Range: >=1.0,<2.4.7
Microchip/TimeProvider 4100 Grandmasterllm-fuzzy
Range: <2.4.7
Microchip/Time Provider 4100llm-fuzzy2 versions
<2.4.7+ 1 more
- (no CPE)range: <2.4.7
- (no CPE)range: 1.0

Patches

Vulnerability mechanics

References

www.gruppotim.it/it/footer/red-team.htmlnvdThird Party Advisory
www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-reflected-xss-vulnerabilitynvdVendor Advisory

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.1/ 10

CVSS v45.4

CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:Green

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

Probability of exploitation in the next 30 days.

11.53%

VYPR risk score

Composite of severity, exploitation, and reach.

0.41medium

cvss	0.397
epss	0.009
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE ID

CVE-2024-43686

Credits

AC
Antonio Carriero
finder
AH
Armando Huesca Prida
finder
DR
Davide Renna
finder
ML
Manuel Leone
finder
MN
Marco Negro
finder
MB
Massimiliano Brolli
finder
VP
Vito Pistillo
finder
TS
TIM Security Red Team Research
reporter