What is the CVSS score of CVE-2025-60965?

CVE-2025-60965 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Sonoma D12 are affected by CVE-2025-60965?

EndRun Sonoma D12 GPS Network Time Servers (firmware Ver 4.00) contain a critical authenticated command injection vulnerability enabling full device compromise and downstream time-manipulation…

How to fix or mitigate CVE-2025-60965?

Within 24 hours: Inventory all Sonoma D12 instances (firmware 6010-0071-000, Ver 4.00); review privileged access logs and restrict administrative credentials to essential personnel only. Within 7 days: Implement network segmentation isolating NTP servers from critical infrastructure; enable comprehensive audit logging of authenticated sessions. Within 30 days: Contact EndRun for patch timeline; evaluate migration to alternative NTP solutions with active vendor support.

Sonoma D12 CVE-2025-60965

CRITICAL

OS Command Injection (CWE-78)

2025-10-06 cve@mitre.org

Command Injection Denial Of Service RCE Sonoma D12 Firmware

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable management interface (AV:N) with low complexity, but requires administrative auth (PR:H); command injection escapes the app to the device OS (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:42 vuln.today

DescriptionCVE.org

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts.

AnalysisAI

Authenticated OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets a privileged remote user inject arbitrary operating-system commands that run outside the vulnerable component, yielding full device takeover, denial of service, privilege escalation, and disclosure of sensitive timing/configuration data. Because Network Time Servers act as an authoritative time source for entire environments, compromise can cascade into time-manipulation attacks against downstream systems (logging, certificates, Kerberos). This is no public exploit identified at time of analysis, though a third-party advisory (xdiv-sec) documents the flaw; EPSS is modest at 1.63% (73rd percentile).

Technical ContextAI

The affected component is the management/administrative interface of an embedded GPS-disciplined Network Time Server appliance (CPE cpe:2.3:o:endruntechnologies:sonoma_d12_firmware:6010-0071-000). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-supplied input is passed into a shell or system() call without adequate sanitization, so shell metacharacters (;, |, &&, backticks, $()) break out of the intended command context and execute on the underlying embedded Linux/RTOS. On appliance-class hardware the web/CLI process frequently runs as root or a high-privilege service account, which is consistent with the CVSS scope-change (S:C) rating: injected commands escape the application sandbox and act on the whole device operating system.

RemediationAI

No vendor-released patch identified at time of analysis; the provided references include the vendor site (http://sonoma.com) and a third-party advisory (https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12) but no fixed firmware version. As compensating controls, restrict management-plane access to the Sonoma D12 by placing it on an isolated out-of-band management VLAN and permitting the web/CLI admin interfaces only from a small allowlist of administrator hosts (trade-off: legitimate remote admins must use a jump host); enforce strong, unique administrator credentials and disable any default accounts to raise the PR:H barrier the exploit depends on; and monitor the appliance and its NTP responses for anomalies since time manipulation affects downstream logging and authentication. Contact EndRun Technologies to confirm a patched firmware release and apply it as the primary fix once available, then rotate admin credentials assuming prior compromise.