GridTime 3000 CVE-2026-12620

Exploitation requires that a high-privilege administrator actively navigates to one of the specific affected endpoints on the GridTime 3000 management interface - the token exposure is triggered by legitimate administrative use, not by unsolicited external input. An attacker must additionally be positioned to observe the resulting URLs, which requires one of the following: read access to server-side access logs or reverse proxy logs, a network-intercept position on the management segment (active or passive), access to the administrator's browser history or autocomplete, or receipt of an HTTP Referer header containing the token URL if the management page links to external resources. The requirement for a high-privilege user session (PR:H in the CVSS 4.0 vector) and active user interaction (UI:A) are the primary limiting factors - the vulnerability cannot be triggered remotely against an idle or unauthenticated device. Impact is strictly limited to confidentiality of the access token; no integrity or availability exploitation is possible through this vector alone.

The CVSS 4.0 base score of 4.6 (Medium) reflects genuinely constrained exploitation conditions: the vulnerable behavior is triggered only when a high-privilege user (PR:H) actively interacts with the affected endpoints (UI:A), and the direct confidentiality impact is rated Low (VC:L), with zero integrity or availability impact. However, the vendor included E:A (Exploit Maturity: Attacked) as a supplemental metric in the same CVSS 4.0 vector, signaling observed exploitation activity - a signal that significantly elevates operational urgency beyond what the base score communicates. Real-world risk is further amplified by the deployment context: GNSS time servers are frequently embedded in critical infrastructure where a stolen management credential, however limited in direct CVSS impact, can serve as a pivot point for broader access or configuration tampering. No EPSS score is available for this CVE in the provided data, and no CISA KEV listing was identified, meaning the E:A signal comes solely from the vendor-supplied vector. The low CVSS confidentiality rating should not be misread as low operational impact - credential exposure in OT/critical timing environments carries outsized downstream consequences.

An attacker with access to a web proxy, load balancer, or server-side access logs on the management network path monitors URLs generated during an administrator's routine session on the GridTime 3000 interface. The attacker extracts the plaintext access token from a logged URL query string and replays it in a crafted HTTP request to the device's management endpoints, successfully impersonating the administrator's session without needing to know their password. No public proof-of-concept tool is identified in the available data, but the technique requires no specialized tooling beyond standard HTTP client capabilities and log-reading access.