This vulnerability (CVE-2025-9497) affects Microchip Time Provider 4100 devices running versions before 2.5.0. It is categorized under CWE-798 for the use of hard-coded credentials. The presence of hard-coded credentials can enable an attacker with appropriate privileges and local access to bypass authentication controls and manually update the software in an unauthorized manner. The CVSS 4.0 vector indicates that exploitation requires local access with high privileges and user interaction is not required. The impact on confidentiality, integrity, and availability is low to high depending on the specific conditions of exploitation.

An attacker with high privileges and local access could leverage the hard-coded credentials to perform unauthorized manual software updates on the affected device. This could potentially compromise the integrity of the device's software. The vulnerability does not appear to allow remote exploitation or require user interaction, limiting the attack surface. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Microchip's advisories for updates. Until a fix is available, restrict local access to trusted personnel only and follow best practices for privilege management to reduce risk.