CVE-2025-60969
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information.
Risk Assessment
An attacker can read sensitive configuration files or credentials, leading to confidentiality breach and potential device takeover.
Recommendation
Immediately update the firmware to the latest version and restrict management interface access to trusted networks only.
Other vulnerabilities in EndRun Technologies Sonoma D12
See all- CVE-2025-60964Critical
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. Attackers can execute arbitrary code, cause denial of service, escalate privileges, obtain sensitive information, and possibly cause other unspecified impacts.
- CVE-2025-60957Critical
An OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, escalate privileges, and obtain sensitive information.
- CVE-2025-60967High
A Cross Site Scripting (XSS) vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware version 6010-0076-000 Ver 4.00. This flaw allows an attacker to inject malicious scripts, potentially leading to the theft of sensitive information.
- CVE-2025-60960High
OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.
- CVE-2025-60959High
An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows attackers to execute arbitrary system commands and gain access to sensitive information.
- CVE-2025-60958High
A Cross Site Scripting (XSS) vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows an attacker to inject malicious scripts, potentially leading to the theft of sensitive information.
Original NVD description (English source)
Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS