The vulnerability is an instance of improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into pages rendered by the TimePictra web interface. The injected code runs in the context of users who view the page, potentially enabling session hijacking, defacement, or other client‑side attacks. The weakness is classified as CWE‑79, indicating a cross‑site scripting flaw.

Microchip TimePictra firmware versions 11.0, 11.1, 11.2, 11.3 and the two service pack releases of 11.3 (SP1 and SP2).

The CVSS base score of 9.3 indicates a severe vulnerability with high confidentiality, integrity, and availability impact. The EPSS score of less than 1% suggests that the probability of exploitation is very low at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is over the web; an attacker with the ability to submit data to the query system can place arbitrary script payloads that will be reflected in generated pages. Successful exploitation would allow the attacker to run arbitrary code in the browser of any user who visits the affected page.