We detect you are using an unsupported browser. For the best experience, please visit the site using Chrome, Firefox, Safari, or Edge. X

Maximize Your Experience: Reap the Personalized Advantages by Completing Your Profile to Its Fullest. Update Here

Stay in the loop with the latest from Microchip. Update your profile while you are at it. Update Here

Complete your profile to access more resources. Update Here

PSIRT-138:TimePictra Platform Root Password Hardcoded in Installation Files

Vulnerability Details

Date of Disclosure: 04/09/2026

Publication Date: 11/09/2026

Affected Product: Microchip TimePictra^® Platform

Vulnerability Type: Use of hard-coded credentials (CWE-798)
CVE Identifier: CVE-2026-8332
CVSS Score: 8.8 (CVSS 4.0)
CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Description:
- A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials
Affected Versions: TimePictra platform versions before 12.0
Vulnerability Status: Resolved in TimePictra 12.0 platform

Risk Assessment

Successful exploitation could expose privileged credentials and lead to unauthorized administrative access, compromising the confidentiality, integrity and availability of TimePictra platform and connected systems.

Mitigation

Upgrade to TimePictra 12.0 platform or later

Patch/Release Information

TimePictra 12.0 platform RPM installation files no longer expose root password details

Acknowledgements

Reported by Dario Emilio Bertani, Andrea Sindoni, Antonio Carriero, Marco Manieri, Vito Pistillo, Davide Renna, Renna Leone and Massimiliano Brolli of TIM Security Red Team Research

Recommendations

It is strongly recommended that all customers upgrade to the TimePictra 12.0 platform or later.