Hard-Coded Root Password Vulnerability in Microchip TimePictra Platform
CVE-2026-8332

8.8HIGH

Key Information:

Vendor

Microchip

Status
Timepictra
Vendor
CVE Published:
12 November 2026

What is CVE-2026-8332?

The TimePictra platform by Microchip is affected by a vulnerability that results from a hard-coded root password present in its installation files. This flaw enables malicious actors with access to these files to leverage the hard-coded credentials for gaining unauthorized privileged access to the system. Organizations using TimePictra should be aware of this issue to prevent potential exploitation and protect sensitive information. It is advisable to review security practices regarding access and consider applying any available patches or mitigations.

Affected Version(s)

TimePictra 0 < 12.0

References

https://www.microchip.com/en-us/solutions/technologies/em...
vendor-advisory
https://www.gruppotim.it/en/footer/TIM-red-team.html
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario Emilio Bertani
Andrea Sindoni
Antonio Carriero
Marco Manieri
Vito Pistillo
Davide Renna
Renna Leone
Massimiliano Brolli
TIM Security Red Team Research
.