CVE-2025-60962
HighCVSS 8.2Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows attackers to gain sensitive information and potentially cause other unspecified impacts.
Risk Assessment
The organization faces the risk of sensitive data leakage and potential takeover of the time server, which could disrupt network time synchronization and affect dependent systems.
Recommendation
Immediately contact the vendor for a firmware update and apply temporary network mitigations, such as restricting device access to trusted hosts only.
Other vulnerabilities in EndRun Technologies Sonoma D12 Network Time Server
See all- CVE-2025-60965Critical
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. Attackers can exploit this to execute arbitrary code, cause denial of service, escalate privileges, obtain sensitive information, and possibly cause other unspecified impacts.
- CVE-2025-60963High
An OS Command Injection vulnerability exists in EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware 6010-0071-000 Ver 4.00. Attackers can execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.
- CVE-2025-60961Medium
A Cross Site Scripting (XSS) vulnerability has been found in EndRun Technologies Sonoma D12 Network Time Server (GPS) running F/W 6010-0071-000 Ver 4.00. Attackers can exploit it to steal sensitive information and possibly cause other unspecified impacts.
- CVE-2025-60956High
A CSRF vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.
Original NVD description (English source)
OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts.