CVE-2024-43687

XSS vulnerability in bannerconfig endpoint in TimeProvider 4100

7.7 HighPublic exploit

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.83%Up 0.8 points since Oct 5, 2024

What each source reports

CVE List Score used 7.7

XSS vulnerability in bannerconfig endpoint in TimeProvider 4100

Record: CVE-2024-43687
CVSS 4.0: 7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/U:Green
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2024-40423 7.7

Record: EUVD-2024-40423
CVSS 4.0: 7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/U:Green
Updated: 2026-11-02

GitHub AdvisoriesGHSA-r25f-mfgv-vq97 0.0

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...

Record: GHSA-r25f-mfgv-vq97
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 7.7

Record: CVE-2024-43687
CVSS 4.0: 7.7 HighCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:X/U:Green
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)	2025-04-04

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-43687 is a high vulnerability (CVSS 7.7) in Microchip Timeprovider 4100, published October 4, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. No source names a fixed version.