CVE-2026-2844

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2844", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "state": "PUBLISHED", "assignerShortName": "Microchip", "dateReserved": "2026-02-20T05:31:04.082Z", "datePublished": "2026-02-28T11:44:07.402Z", "dateUpdated": "2026-03-02T15:23:13.286Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra-11", "defaultStatus": "unaffected", "product": "TimePictra", "vendor": "Microchip", "versions": [{"lessThanOrEqual": "11.3 SP2", "status": "affected", "version": "11.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Steve Lin"}, {"lang": "en", "type": "reporter", "value": "Bastion Security"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.<p>This issue affects TimePictra: from 11.0 through 11.3 SP2.</p>"}], "value": "Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2."}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-02-28T11:44:07.402Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-authentication-bypass-vulnerability"}], "source": {"advisory": "PSIRT-125", "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-02-04T23:00:00.000Z", "value": "Reported"}], "title": "TimePictra Authentication Bypass Vulnerability", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><p>Control access to the web application</p></div></div>"}], "value": "Control access to the web application"}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T15:22:36.224920Z", "id": "CVE-2026-2844", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:23:13.286Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2844", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T15:22:36.224920Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:22:45.274Z"}}], "cna": {"title": "TimePictra Authentication Bypass Vulnerability", "source": {"advisory": "PSIRT-125", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Steve Lin"}, {"lang": "en", "type": "reporter", "value": "Bastion Security"}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Microchip", "product": "TimePictra", "versions": [{"status": "affected", "version": "11.0", "versionType": "custom", "lessThanOrEqual": "11.3 SP2"}], "collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra-11", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-04T23:00:00.000Z", "value": "Reported"}], "references": [{"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-authentication-bypass-vulnerability", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Control access to the web application", "supportingMedia": [{"type": "text/html", "value": "<div><div><p>Control access to the web application</p></div></div>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.", "supportingMedia": [{"type": "text/html", "value": "Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.<p>This issue affects TimePictra: from 11.0 through 11.3 SP2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-02-28T11:44:07.402Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2844", "state": "PUBLISHED", "dateUpdated": "2026-03-02T15:23:13.286Z", "dateReserved": "2026-02-20T05:31:04.082Z", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "datePublished": "2026-02-28T11:44:07.402Z", "assignerShortName": "Microchip"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra-11", "defaultStatus": "unaffected", "product": "TimePictra", "vendor": "Microchip", "versions": [{"lessThanOrEqual": "11.3 SP2", "status": "affected", "version": "11.0", "versionType": "custom"}]}], "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microchip:timepictra:*:*:*:*:*:*:*:*", "matchCriteriaId": "263ED5AC-661E-429E-BDEA-ED4D5D56B311", "versionEndIncluding": "11.3", "versionStartIncluding": "11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microchip:timepictra:11.3:sp1:*:*:*:*:*:*", "matchCriteriaId": "6C40D373-49C5-4CDE-B64E-4E1F753F70F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microchip:timepictra:11.3:sp2:*:*:*:*:*:*", "matchCriteriaId": "EEA3EA8F-E92B-4350-A007-D822AE7757A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2."}, {"lang": "es", "value": "Vulnerabilidad de Ausencia de Autenticaci\u00f3n para Funci\u00f3n Cr\u00edtica en Microchip TimePictra permite Manipulaci\u00f3n de Configuraci\u00f3n/Entorno. Este problema afecta a TimePictra: desde 11.0 hasta 11.3 SP2."}], "id": "CVE-2026-2844", "lastModified": "2026-06-17T10:31:52.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2844", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T15:22:36.224920Z", "version": "2.0.3"}}]}, "published": "2026-02-28T12:16:37.713", "references": [{"source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "tags": ["Vendor Advisory"], "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-authentication-bypass-vulnerability"}], "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0,11.3 SP2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "TimePictra", "source": "cna", "vendor": "Microchip"}, "product": "timepictra", "vendor": "microchip"}], "analysis": {"en": {"generated_at": "2026-04-16T15:06:22.425331+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch when one becomes available", "Configure network access controls to restrict connection to the TimePictra web application", "Limit or disable the affected configuration function if possible", "Monitor system logs for unauthorized configuration changes"], "summary": {"action": "Control Access", "impact": "Unauthorized Configuration Access"}, "threat_synthesis": {"affected_systems": "The affected product is Microchip TimePictra, versions 11.0 through 11.3 SP2. Users running these releases are susceptible to the authentication bypass and may be able to alter configuration and environment settings without proper credentials.", "description_and_impact": "Microchip TimePictra suffers from a missing authentication check for a critical configuration function, which permits an attacker to modify system settings and the operating environment. The vulnerability can enable unauthorized manipulation of device behavior, potentially compromising device integrity and availability. The weakness is identified as CWE-306, indicating a missing authentication flaw.", "risk_and_exploitability": "The CVSS score is 9.3, classifying the issue as critical. The EPSS score is less than 1%, suggesting limited current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the web application interface that offers the configuration functionality; an attacker would need network access to the device\u2019s web server to exploit the flaw. If exploited, an attacker could gain unauthorized access to modify critical settings, which could lead to service disruption or further compromise of the embedded system."}}}}, "created": "2026-03-02T12:04:24.995720+00:00", "updated": "2026-04-16T15:15:39.040490+00:00", "vendors": ["microchip", "microchip$PRODUCT$timepictra"]}