Microchip vulnerabilities
We track 16 vulnerabilities in Microchip products across 10 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest Microchip vulnerabilities
- 9.4 Critical severity
TimePictra: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page
- 8.8 High severity
TimePictra: Use of Hard-coded Credentials
A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials
- 8.8 High severity
TimePictra: Unrestricted Upload of File with Dangerous Type
An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.
- 7.3 High severity
SAMA5D4: Improper Protection Against Voltage and Clock Glitches
Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.
- 8.8 High severity
IStaX: Insufficient Entropy
A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects
- 7.5 High severity
TimePictra: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.
- 8.8 High severity
Time Provider 4100: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.
- 8.8 High severity
Time Provider 4100: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.
- 8.8 High severity
Time Provider 4100: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.
- 8.8 High severity
TimeProvider 4100: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affe
- 9.8 Critical severity
Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows…
Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
- 8.8 High severity
TimeProvider 4100: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.
- 9.8 Critical severity
Advanced Software Framework: Buffer Copy without Checking Size of Input
Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer overflow. This vulnerability is associated with program files tinydhcpserver.C and program routines
- 7.0 High severity
MPLAB® Harmony 3 Core Module: Integer Overflow or Wraparound
If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can
- 9.8 Critical severity
A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage…
A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView
- 10.0 Critical severity
Maxview Storage Manager: Improper Access Control
In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system management, unauthorized access can occur, with data modification and information disclosure. This affect