{"id":"CVE-2026-8332","kind":"vulnerability","aliases":["CVE-2026-8332"],"related":[],"title":"Microchip TimePictra: hard-coded root password in installation files exposes admin access","description":"A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials","summary":"Microchip's TimePictra platform ships installation files containing a hard-coded root password. Anyone who obtains those files can log in with privileged root credentials.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TimePictra","fixed":["12.0"],"affected":"< 12.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","microchip","self-hosted","timepictra"],"not_affected_if":[],"how_to_check":"Check the installed TimePictra platform version; anything before 12.0 is affected. Check who can read the TimePictra installation files/RPMs (file shares, backups, artifact repos, deployment hosts). If you can't upgrade yet, restrict access to those files and rotate or change the root password on installed systems (rotation is our suggestion; Microchip's advisory states only the upgrade).","fix":"Upgrade TimePictra platform to 12.0 or later; its RPM installation files no longer expose the root password.","status":"open","published_at":"2026-11-12T07:16:48+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","triaged_at":"2026-11-12T07:38:04+00:00","updated_at":"2026-11-12T07:39:36+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-12T07:38:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microchip TimePictra: hard-coded root password in installation files exposes admin access","impact":"high","summary":"Microchip's TimePictra platform ships installation files containing a hard-coded root password. Anyone who obtains those files can log in with privileged root credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["microchip","timepictra","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker obtains root credentials for the TimePictra platform","analyst_note":"Confirm affected TimePictra versions, the vendor fix and the exact access an attacker needs, from the NVD entry or Microchip's advisory.","how_to_check":"- Locate the TimePictra installation files on your systems and search them for a hard-coded root password string\n- Check the installed TimePictra version against the vendor advisory\n- unknown for any other check, since the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Microchip TimePictra, a platform for timing and synchronization equipment, are exposed if the installation files are accessible to an attacker. The sources do not name affected versions or the exact deployment conditions. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4493,"output_tokens":490,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected TimePictra versions, the vendor fix and the exact access an attacker needs, from the NVD entry or Microchip's advisory.","search":"'-2026':15A,18A '-8332':16A,19A 'access':13A,70C 'admin':12A 'allow':66C 'anyon':41B 'attack':68C 'code':5A,38B,56C 'contain':34B 'could':65C 'credenti':52B,77C 'cve':14A,17A 'expos':11A 'file':10A,33B,45B,64C,73C 'hard':4A,37B,55C 'hard-cod':3A,36B,54C 'host':25B 'infrastructur':21B 'instal':9A,32B,63C 'log':47B 'microchip':1A,22B,27B,60C 'obtain':43B,75C 'password':7A,40B,58C 'platform':30B,62C 'privileg':50B,76C 'root':6A,39B,51B,57C 'self':24B 'self-host':23B 'ship':31B 'timepictra':2A,20A,26B,29B,61C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the self-hosted Microchip TimePictra platform (timing and synchronization management) in versions before 12.0. An attacker needs access to the installation files (RPM packages) to read the hard-coded root password, so exposure depends on who can reach those files and the installed system. Teams on 12.0 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T07:39:36Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files","run_id":3715},"products":{"at":"2026-11-12T07:39:36Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files","run_id":3715},"who_affected":{"at":"2026-11-12T07:39:36Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files","run_id":3715}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["timepictra"],"ptokens":["timepictra"],"labels":["high","infrastructure","microchip","selfhosted","timepictra"],"campaign_type":null,"search_a":"'-2026':15A,18A '-8332':16A,19A 'access':13A 'admin':12A 'code':5A 'cve':14A,17A 'expos':11A 'file':10A 'hard':4A 'hard-cod':3A 'instal':9A 'microchip':1A 'password':7A 'root':6A 'timepictra':2A,20A","search_b":"'anyon':41B 'code':38B 'contain':34B 'credenti':52B 'file':33B,45B 'hard':37B 'hard-cod':36B 'host':25B 'infrastructur':21B 'instal':32B 'log':47B 'microchip':22B,27B 'obtain':43B 'password':40B 'platform':30B 'privileg':50B 'root':39B,51B 'self':24B 'self-host':23B 'ship':31B 'timepictra':26B,29B","search_c":"'access':70C 'allow':66C 'attack':68C 'code':56C 'could':65C 'credenti':77C 'file':64C,73C 'hard':55C 'hard-cod':54C 'instal':63C 'microchip':60C 'obtain':75C 'password':58C 'platform':62C 'privileg':76C 'root':57C 'timepictra':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8332","severity":null,"published_at":"2026-11-12T07:16:48+00:00","modified_at":"2026-11-12T07:16:48+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","fetched_at":"2026-11-12T07:37:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8332:3715","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files","severity":null,"published_at":"2026-11-12T07:39:36+00:00","modified_at":"2026-11-12T07:39:36+00:00","first_seen_at":"2026-11-12T07:39:36+00:00","fetched_at":"2026-11-12T07:39:36+00:00","note":"Read Microchip PSIRT-138: affected before 12.0, fixed in 12.0 (RPM installs no longer expose root password). No exploitation or PoC found.","cites":["https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files"]}],"documents":[{"id":132940,"url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files","title":"PSIRT-138: TimePictra Platform Root Password Hardcoded in Installation Files","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}