CVE-2025-60967
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server allows attackers to inject malicious scripts into web interfaces, potentially stealing sensitive information or performing unauthorized actions. Organizations using the affected firmware version are at risk.
💻 Affected Systems
- EndRun Technologies Sonoma D12 Network Time Server (GPS)
📦 What is this software?
Sonoma D12 Firmware by Endruntechnologies
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, manipulate device settings, or use the device as a pivot point to attack internal networks.
Likely Case
Attackers steal session cookies or authentication tokens to gain unauthorized access to the device management interface.
If Mitigated
With proper network segmentation and access controls, impact is limited to the device itself without lateral movement.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity once the vulnerable endpoint is identified
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://endrun.com
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates
2. Download latest firmware
3. Upload via web interface
4. Reboot device
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to the device management interface to trusted networks only
Web Application Firewall
allDeploy WAF with XSS protection rules in front of the device
🧯 If You Can't Patch
- Isolate the device on a separate VLAN with strict access controls
- Disable web management interface if not required and use alternative management methods
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > About or similar menuCheck Version:
No CLI command available - check via web interfaceVerify Fix Applied:
Verify firmware version has been updated beyond Ver 4.00📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to management interface with script tags or encoded payloads
Network Indicators:
- HTTP requests containing suspicious script injection patterns to port 80/443
SIEM Query:
http.method=POST AND http.uri_path CONTAINS "/cgi-bin/" AND (http.user_agent CONTAINS "script" OR http.request_body CONTAINS "<script>")