CVE-2025-60958
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows an attacker to inject malicious scripts, potentially leading to the theft of sensitive information.
Risk Assessment
The organization is at risk of sensitive data leakage, such as credentials or user sessions, which could result in network security breaches and loss of trust.
Recommendation
Immediately update the server firmware to the latest version if a patch is available from the vendor. Until then, restrict access to the management interface to trusted networks only.
Other vulnerabilities in EndRun Technologies Sonoma D12
See all- CVE-2025-60964Critical
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. Attackers can execute arbitrary code, cause denial of service, escalate privileges, obtain sensitive information, and possibly cause other unspecified impacts.
- CVE-2025-60957Critical
An OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, escalate privileges, and obtain sensitive information.
- CVE-2025-60969Medium
A Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information.
- CVE-2025-60967High
A Cross Site Scripting (XSS) vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware version 6010-0076-000 Ver 4.00. This flaw allows an attacker to inject malicious scripts, potentially leading to the theft of sensitive information.
- CVE-2025-60960High
OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.
- CVE-2025-60959High
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows attackers to execute arbitrary system commands and gain access to sensitive information.
Original NVD description (English source)
Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information.