Microchip TimeProvider 4100: SQL Injection Vulnerability Strikes Again!
The TimeProvider 4100 Grandmaster firmware has a SQL injection vulnerability in the get_chart_data web resource. The channelId parameter is the key to this hilarious blunder, allowing unauthenticated threat actors to perform malicious SQL commands. It’s like handing the keys to the database kingdom, no password required!
Hot Take:
Looks like the TimeProvider 4100 has time-traveled back to the era of SQL injection vulnerabilities! Who knew a device designed to keep time could be so behind the times in cybersecurity? Guess it’s time for Microchip to update their firmware before the hackers clock in!
Key Points:
- Microchip TimeProvider 4100 Grandmaster has an unauthenticated SQL injection vulnerability.
- Discovered by Armando Huesca Prida and team, with CVE-2024-7801 assigned.
- The vulnerability affects firmware versions 1.0 through 2.4.7.
- Exploit involves manipulating the “channelId” parameter of the “get_chart_data” web resource.
- Proof of concept involves modifying HTTP requests to execute malicious SQL commands.
Already a member? Log in here