CVE-2026-3010

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3010", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "state": "PUBLISHED", "assignerShortName": "Microchip", "dateReserved": "2026-02-23T06:04:48.706Z", "datePublished": "2026-02-28T11:45:30.301Z", "dateUpdated": "2026-03-02T15:21:20.403Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra-11", "defaultStatus": "unaffected", "product": "TimePictra", "vendor": "Microchip", "versions": [{"lessThanOrEqual": "11.3 SP2", "status": "affected", "version": "11.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Steve Lin"}, {"lang": "en", "type": "reporter", "value": "Bastion Security"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.<p>This issue affects TimePictra: from 11.0 through 11.3 SP2.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2."}], "impacts": [{"capecId": "CAPEC-54", "descriptions": [{"lang": "en", "value": "CAPEC-54 Query System for Information"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-02-28T11:45:30.301Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting"}], "source": {"advisory": "PSIRT-126", "discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-02-04T23:00:00.000Z", "value": "Reported"}], "title": "TimePictra Stored Cross-Site Scripting", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Control access to the web application</p>"}], "value": "Control access to the web application"}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T15:20:07.391735Z", "id": "CVE-2026-3010", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:21:20.403Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3010", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "state": "PUBLISHED", "assignerShortName": "Microchip", "dateReserved": "2026-02-23T06:04:48.706Z", "datePublished": "2026-02-28T11:45:30.301Z", "dateUpdated": "2026-03-02T15:21:20.403Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra-11", "defaultStatus": "unaffected", "product": "TimePictra", "vendor": "Microchip", "versions": [{"lessThanOrEqual": "11.3 SP2", "status": "affected", "version": "11.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Steve Lin"}, {"lang": "en", "type": "reporter", "value": "Bastion Security"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.<p>This issue affects TimePictra: from 11.0 through 11.3 SP2.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2."}], "impacts": [{"capecId": "CAPEC-54", "descriptions": [{"lang": "en", "value": "CAPEC-54 Query System for Information"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-02-28T11:45:30.301Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting"}], "source": {"advisory": "PSIRT-126", "discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-02-04T23:00:00.000Z", "value": "Reported"}], "title": "TimePictra Stored Cross-Site Scripting", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Control access to the web application</p>"}], "value": "Control access to the web application"}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3010", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T15:20:07.391735Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:21:07.535Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra-11", "defaultStatus": "unaffected", "product": "TimePictra", "vendor": "Microchip", "versions": [{"lessThanOrEqual": "11.3 SP2", "status": "affected", "version": "11.0", "versionType": "custom"}]}], "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microchip:timepictra:*:*:*:*:*:*:*:*", "matchCriteriaId": "263ED5AC-661E-429E-BDEA-ED4D5D56B311", "versionEndIncluding": "11.3", "versionStartIncluding": "11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microchip:timepictra:11.3:sp1:*:*:*:*:*:*", "matchCriteriaId": "6C40D373-49C5-4CDE-B64E-4E1F753F70F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microchip:timepictra:11.3:sp2:*:*:*:*:*:*", "matchCriteriaId": "EEA3EA8F-E92B-4350-A007-D822AE7757A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web (XSS o 'cross-site scripting') en Microchip TimePictra permite la Consulta del Sistema para Informaci\u00f3n. Este problema afecta a TimePictra: desde 11.0 hasta 11.3 SP2."}], "id": "CVE-2026-3010", "lastModified": "2026-06-17T10:42:52.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3010", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T15:20:07.391735Z", "version": "2.0.3"}}]}, "published": "2026-02-28T12:16:39.317", "references": [{"source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "tags": ["Vendor Advisory"], "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting"}], "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0,11.3 SP2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "TimePictra", "source": "cna", "vendor": "Microchip"}, "product": "timepictra", "vendor": "microchip"}], "analysis": {"en": {"generated_at": "2026-04-16T15:05:55.850178+00:00", "value": {"mitigation_remediation": ["Install any Microchip security patch for TimePictra versions 11.0 through 11.3 SP2 that addresses XSS issues.", "Restrict access to the TimePictra web application to trusted users or networks, effectively limiting the attack surface.", "Implement a strict content\u2011security\u2011policy header to mitigate the impact of any remaining reflected or stored script payloads."], "summary": {"action": "Immediate Patch", "impact": "Client\u2011side code injection causing potential defacement or theft of session data"}, "threat_synthesis": {"affected_systems": "Microchip TimePictra firmware versions 11.0, 11.1, 11.2, 11.3 and the two service pack releases of 11.3 (SP1 and SP2).", "description_and_impact": "The vulnerability is an instance of improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into pages rendered by the TimePictra web interface. The injected code runs in the context of users who view the page, potentially enabling session hijacking, defacement, or other client\u2011side attacks. The weakness is classified as CWE\u201179, indicating a cross\u2011site scripting flaw.", "risk_and_exploitability": "The CVSS base score of 9.3 indicates a severe vulnerability with high confidentiality, integrity, and availability impact. The EPSS score of less than 1% suggests that the probability of exploitation is very low at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is over the web; an attacker with the ability to submit data to the query system can place arbitrary script payloads that will be reflected in generated pages. Successful exploitation would allow the attacker to run arbitrary code in the browser of any user who visits the affected page."}}}}, "created": "2026-03-02T12:04:24.133031+00:00", "updated": "2026-04-16T15:15:39.039789+00:00", "vendors": ["microchip", "microchip$PRODUCT$timepictra"]}