High severity8.8NVD Advisory· Published Oct 20, 2025· Updated Jun 17, 2026

CVE-2025-47902

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Microchip/Time Provider 4100llm-fuzzy2 versions
<2.5+ 1 more
- (no CPE)range: <2.5
- (no CPE)range: 0
Microchip/Timeprovider 4100 Firmware
cpe:2.3:o:microchip:timeprovider_4100_firmware:*:*:*:*:*:*:*:*
Range: <2.5

Patches

Vulnerability mechanics

References

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

8.8/ 10

CVSS v47.1

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

0.35%

VYPR risk score

Composite of severity, exploitation, and reach.

0.57high

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE ID

CVE-2025-47902

Credits

AS
Andrea Sindoni
finder
AC
Antonio Carriero
finder
DE
Dario Emilio Bertani
finder
DR
Davide Renna
finder
ML
Manuel Leone
finder
MM
Marco Manieri
finder
MB
Massimiliano Brolli
finder
RB
Raffaele Bova
finder
SB
Simone Bossi
finder
VP
Vito Pistillo
finder
TS
TIM Security Red Team Research (TIM S.p.A)
reporter