CVE-2024-43687: XSS vulnerability in bannerconfig endpoint in TimeProvider 4100
Published Oct 4, 2024
·Updated
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
Affected Software
2 affected components
All of the following
Microchip Timeprovider 4100 Firmware>=1.0<2.4.7
Microchip TimeProvider 4100
Remediation
Information
Separate the access to the management port and the timing service ports into separate networks with appropriate access controls.
Event History
Oct 4, 2024
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
RemedyDescriptionWeakness
Apr 4, 2025
Exploit Published
12:00 AM
Known Exploited
09:45 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-43687?
CVE-2024-43687 has a high severity rating due to its potential for Cross-Site Scripting (XSS) attacks.
2
How do I fix CVE-2024-43687?
To fix CVE-2024-43687, update the Microchip TimeProvider 4100 firmware to version 2.4.7 or later.
3
What versions of Microchip TimeProvider 4100 are affected by CVE-2024-43687?
CVE-2024-43687 affects Microchip TimeProvider 4100 versions from 1.0 to 2.4.6.
4
Can CVE-2024-43687 lead to unauthorized access?
Yes, CVE-2024-43687 can potentially lead to unauthorized access through XSS exploitation.
5
What type of vulnerability is CVE-2024-43687 classified as?
CVE-2024-43687 is classified as an Improper Neutralization of Input During Web Page Generation vulnerability, also known as XSS.