CVE-2025-60961
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server allows attackers to inject malicious scripts into web interfaces. Attackers could steal sensitive information, manipulate device settings, or perform other unauthorized actions. Organizations using this specific firmware version are affected.
💻 Affected Systems
- EndRun Technologies Sonoma D12 Network Time Server (GPS)
📦 What is this software?
Sonoma D12 Firmware by Endruntechnologies
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of device configuration, credential theft, persistent backdoor installation, and lateral movement to connected systems.
Likely Case
Session hijacking, sensitive information disclosure (credentials, configuration data), and limited device manipulation.
If Mitigated
Limited impact due to network segmentation, input validation, and proper access controls preventing script execution.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity, especially when unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://endrun.com
Restart Required: Yes
Instructions:
1. Check vendor website for security advisories. 2. Download updated firmware if available. 3. Backup current configuration. 4. Apply firmware update via web interface or console. 5. Verify functionality post-update.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to device management interface to trusted networks only.
Web Application Firewall
allDeploy WAF with XSS protection rules to filter malicious inputs.
🧯 If You Can't Patch
- Isolate device on separate VLAN with strict firewall rules
- Disable web management interface if not required, use console access only
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > Status > Firmware VersionCheck Version:
curl -k https://[device-ip]/status | grep 'Firmware Version'Verify Fix Applied:
Verify firmware version is no longer 4.00 and test XSS payloads are sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests with script tags
- Multiple failed login attempts followed by script injection attempts
Network Indicators:
- HTTP requests containing <script>, javascript:, or other XSS payloads to device IP
SIEM Query:
source="sonoma-d12-logs" AND (http_uri="*<script>*" OR http_uri="*javascript:*")