CVE-2024-7801 - CVE House
Back to Database
Status published Medium CVE-2024-7801

SQL injection in get_chart_data in TimeProvider 4100

Vulnerability Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7801

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Armando Huesca Prida
  • Marco Negro
  • Antonio Carriero
  • Vito Pistillo
  • Davide Renna
  • Manuel Leone
  • Massimiliano Brolli
  • TIM Security Red Team Research

References

More from Microchip

View All →
CVE-2025-9497
Hardcoded Upgrade Decryption Passwords
Medium 5.5
CVE-2025-47904
Unsigned upgrade package
Medium 5.7
CVE-2025-47902
SQL Injection in web resource
High 7.1
CVE-2025-47901
RCE on restore configuration password
High 8.9
CVE-2025-47900
RCE on backup configuration password
High 8.9

Affected Vendor

Affected Software

TimeProvider 4100
Vulnerable Versions:
1.0

Timeline

Official Publish: October 4th, 2024
Last Modified: October 4th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact