Microchip vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-18349 Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.High 7.3 · Aug 24, 2026
• CVE-2026-2336 A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own High 8.7 · Apr 16, 2026
• CVE-2026-3010 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for InformCritical 9.3 · Feb 28, 2026
• CVE-2026-2844 Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: Critical 9.3 · Feb 28, 2026
• CVE-2025-47902 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issHigh 7.1 · Oct 20, 2025
• CVE-2025-47901 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command InjecHigh 8.9 · Oct 20, 2025
• CVE-2025-47900 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command InjecHigh 8.9 · Oct 20, 2025
• CVE-2024-9054 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerabiHigh 8.5 · Oct 4, 2024
• CVE-2024-43687 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules)High 7.7 · Oct 4, 2024
• CVE-2024-43685 Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 befHigh 8.7 · Oct 4, 2024
• CVE-2024-43684 Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects High 8.7 · Oct 4, 2024
• CVE-2024-43683 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProviderHigh 8.7 · Oct 4, 2024
• CVE-2024-30212 If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte ofHigh 7 · May 28, 2024
• CVE-2024-22216 In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system managCritical 10 · Jan 8, 2024
• CVE-2020-27636 In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.Critical 9.1 · Oct 10, 2023
• CVE-2022-40022 Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.Critical 9.8 · Feb 13, 2023
• CVE-2022-46403 The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.High 8.6 · Dec 19, 2022
• CVE-2022-46399 The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.High 7.5 · Dec 19, 2022
• CVE-2021-37605 In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity CheckHigh 7.5 · Aug 5, 2021
• CVE-2021-37604 In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated High 7.5 · Aug 5, 2021
• CVE-2019-16127 Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow.Critical 9.1 · Oct 22, 2020
• CVE-2020-12789 The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.High 7.5 · Sep 14, 2020
• CVE-2020-12788 CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.High 7.5 · Sep 14, 2020
• CVE-2020-12787 Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.High 7.5 · Sep 14, 2020
• CVE-2020-9034 Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creatHigh 7.5 · Feb 16, 2020