CVE-2025-60956
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A CSRF vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.
Risk Assessment
An attacker can exploit CSRF to take control of the device, leading to compromise of data integrity and confidentiality, as well as network disruption.
Recommendation
Immediately update the firmware to the latest version and implement CSRF protections such as anti-CSRF tokens and Origin header validation.
Other vulnerabilities in EndRun Technologies Sonoma D12 Network Time Server
See all- CVE-2025-60965Critical
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. Attackers can exploit this to execute arbitrary code, cause denial of service, escalate privileges, obtain sensitive information, and possibly cause other unspecified impacts.
- CVE-2025-60963High
An OS Command Injection vulnerability exists in EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware 6010-0071-000 Ver 4.00. Attackers can execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.
- CVE-2025-60962High
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows attackers to gain sensitive information and potentially cause other unspecified impacts.
- CVE-2025-60961Medium
A Cross Site Scripting (XSS) vulnerability has been found in EndRun Technologies Sonoma D12 Network Time Server (GPS) running F/W 6010-0071-000 Ver 4.00. Attackers can exploit it to steal sensitive information and possibly cause other unspecified impacts.
Original NVD description (English source)
Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.