What is the CVSS score of CVE-2025-60964?

CVE-2025-60964 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Sonoma D12 Firmware are affected by CVE-2025-60964?

EndRun Sonoma D12 GPS Network Time Servers-critical infrastructure used for network-wide time synchronization-contain a CRITICAL command injection vulnerability enabling authenticated administrative…

How to fix or mitigate CVE-2025-60964?

Within 24 hours: Inventory all EndRun Sonoma D12 units (firmware 6010-0071-000, Ver 4.00) in production, identify and audit all high-privilege operator accounts with access, and enable administrative command audit logging. Within 7 days: Restrict administrative access to a minimum set of essential personnel, implement network segmentation to isolate timing servers behind firewalls, document secondary/redundant timing sources, and contact EndRun Technologies for patch timeline. Within 30 days: Deploy monitored failover capability to secondary time source, establish alerting for anomalous shell command execution, and conduct access reviews quarterly until patch is released.

Sonoma D12 Firmware CVE-2025-60964

CRITICAL

OS Command Injection (CWE-78)

2025-10-06 cve@mitre.org

Command Injection Denial Of Service RCE Sonoma D12 Firmware

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:41 vuln.today

DescriptionCVE.org

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts.

AnalysisAI

OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets an authenticated high-privileged operator inject shell commands into the appliance's underlying OS, escaping the management application to run arbitrary code as the device. Because the appliance is a hardened timing source, successful exploitation yields full compromise: code execution, denial of service, privilege escalation, and disclosure of sensitive data. No public exploit is identified at time of analysis, though a third-party research advisory (xdiv-sec) documents the finding; the EPSS score is moderate at 1.63% (73rd percentile) and the CVE is not on CISA KEV.