Microchip TimePictra suffers from a missing authentication check for a critical configuration function, which permits an attacker to modify system settings and the operating environment. The vulnerability can enable unauthorized manipulation of device behavior, potentially compromising device integrity and availability. The weakness is identified as CWE-306, indicating a missing authentication flaw.

The affected product is Microchip TimePictra, versions 11.0 through 11.3 SP2. Users running these releases are susceptible to the authentication bypass and may be able to alter configuration and environment settings without proper credentials.

The CVSS score is 9.3, classifying the issue as critical. The EPSS score is less than 1%, suggesting limited current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the web application interface that offers the configuration functionality; an attacker would need network access to the device’s web server to exploit the flaw. If exploited, an attacker could gain unauthorized access to modify critical settings, which could lead to service disruption or further compromise of the embedded system.