Is CVE-2025-9497 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-9497 being exploited in the wild.

How severe is CVE-2025-9497?

Critical severity, with a CVSS score of 9.8, published 28 March 2026.

Which products and versions are affected?

Microchip Time Provider 4100 before 2.5.0.

Is there a fix for CVE-2025-9497?

A patch was published on 2025-02-05: Fix available in version 2.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-9497 attacked?

It is attacked over the network.

Am I affected by CVE-2025-9497?

Check whether you run Microchip Time Provider 4100, Microchip Timeprovider 4100 or Microchip Timeprovider 4100 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-9497: Microchip Time Provider 4100 hard-coded credentials in software update

CVE-2025-9497 · Severity: critical · CVSS 9.8 · Published 2026-03-28

The Microchip Time Provider 4100 is a critical network timing appliance used to synchronize clocks and maintain accurate time across infrastructure and enterprise networks. An attacker with network access can exploit hard-coded credentials in the device's software update mechanism to perform unauthorized firmware updates, potentially compromising time synchronization, introducing timing attacks, or establishing a persistent foothold in sensitive network environments.

Technologies: Microchip Timeprovider 4100, Microchip Timeprovider 4100 Firmware. Vendors: Microchip.

Quick answers

Is CVE-2025-9497 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-9497 being exploited in the wild.
How severe is CVE-2025-9497?: Critical severity, with a CVSS score of 9.8, published 28 March 2026.
Which products and versions are affected?: Microchip Time Provider 4100 before 2.5.0.
Is there a fix for CVE-2025-9497?: A patch was published on 2025-02-05: Fix available in version 2.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-9497 attacked?: It is attacked over the network.
Am I affected by CVE-2025-9497?: Check whether you run Microchip Time Provider 4100, Microchip Timeprovider 4100 or Microchip Timeprovider 4100 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability involves the use of hard-coded credentials embedded in the Time Provider 4100 firmware that protect the software update/upgrade mechanism. An attacker with network access to the device can use these credentials to bypass authentication controls and initiate malicious firmware updates without proper authorization. The vulnerability allows complete compromise of the device and may enable arbitrary code execution, denial of service, or persistent compromise. Patches are available in version 2.5.0 and later; devices running versions before 2.5.0 are affected and should be updated immediately.

Affected products

Microchip Time Provider 4100 before 2.5.0

Timeline

2026-03-28: disclosed
2025-02-05: patched: Fix available in version 2.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.