What is the CVSS score of CVE-2025-60963?

CVE-2025-60963 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 1.2%.

Which versions of Sonoma D12 are affected by CVE-2025-60963?

The EndRun Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) contains an unauthenticated remote code execution vulnerability; no public exploit has been identified at time of…

How to fix or mitigate CVE-2025-60963?

24 hours: Inventory all EndRun Sonoma D12 systems running firmware 6010-0071-000 Ver 4.00 and document current network access controls. 7 days: Implement network segmentation restricting inbound access to the Sonoma D12 to authorized NTP time-sync clients only; block or filter unnecessary management ports at the network perimeter. 30 days: Monitor EndRun Technologies vendor advisories for firmware patch availability and establish change management procedures for firmware upgrade deployment.

Sonoma D12 CVE-2025-60963

HIGH

OS Command Injection (CWE-78)

2025-10-06 cve@mitre.org

Command Injection Denial Of Service RCE Sonoma D12 Firmware

8.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

9.8 CRITICAL

Network-reachable, low-complexity OS command injection with no confirmed auth requirement yields full C/I/A on the appliance; PR:N retained per NVD but auth is unverified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:39 vuln.today

DescriptionCVE.org

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.

AnalysisAI

OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject shell commands that the appliance executes, enabling arbitrary code execution, denial of service, privilege escalation, and disclosure of sensitive data. The NVD CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N) and a third-party technical advisory (xdiv-sec) has been published, but there is no public exploit identified at time of analysis and the flaw is not on CISA KEV. EPSS is modest at 1.20% (64th percentile), indicating no observed mass exploitation to date.

Technical ContextAI

The Sonoma D12 is a GPS-disciplined network time server (NTP/PTP timing appliance) used to distribute precise time to networked infrastructure, typically administered through an embedded management interface (web/CLI/SNMP). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): attacker-controlled input is passed into a shell or system() call on the underlying embedded Linux/RTOS without sanitization, so metacharacters (;, |, `, $()) break out of the intended command and run arbitrary OS commands with the privileges of the handling process - commonly root on such appliances. The affected component is precisely identified by CPE cpe:2.3:o:endruntechnologies:sonoma_d12_firmware:6010-0071-000, i.e. the firmware image 6010-0071-000 Ver 4.00.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the available data at time of analysis, so remediation must currently rely on compensating controls: place the Sonoma D12 management interfaces on an isolated, out-of-band management VLAN and restrict access with an ACL/firewall so only trusted administration hosts can reach the web/CLI/SNMP services (trade-off: legitimate remote admin must go through a jump host); disable any unused remote management protocols on the appliance to shrink the attack surface; and monitor the device for anomalous outbound connections or configuration changes. Contact EndRun Technologies (http://sonoma.com) for a fixed firmware build and consult the third-party advisory (https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12) for the specific vulnerable endpoint so that endpoint can be blocked at a reverse proxy if the interface must remain exposed. Because the device is a timing trust anchor, also audit downstream NTP/PTP clients for signs of time manipulation.