CVE-2026-12620
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This affects versions from 1.0r0.03 through 1.1r0.0.
Risk Assessment
An attacker can intercept the access token from server logs, browser history, or network traffic, enabling unauthorized access to the device.
Recommendation
Immediately update the GridTime 3000 firmware to a version later than 1.1r0.0 and avoid transmitting tokens in URL parameters.
Other vulnerabilities in GridTime 3000
See all- CVE-2026-12622Medium
The GridTime 3000 GNSS Time Server contains an open redirect vulnerability in the password change form submission. An attacker can exploit this flaw to redirect users to a malicious site after a password change.
- CVE-2026-12621Medium
A cross-site scripting (XSS) vulnerability was found in the GridTime 3000 password reset form due to improper input neutralization during web page generation. The issue affects versions from 1.0r0.03 before 1.2r0.0.
Original NVD description (English source)
The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.