GridTime 3000 CVE-2026-12621

Exploitation requires a valid low-privilege authenticated session on the GridTime 3000 web management interface - unauthenticated exploitation is not supported by the CVSS 4.0 vector (PR:L). The specific vulnerable component is the password reset form within the web UI; no other form or endpoint is identified. A second user (e.g., an administrator) must load the page containing the injected payload for the XSS to execute in a victim context, which is the primary limiting factor. The attack is bounded to deployments where the web interface is network-reachable; devices whose management ports are firewalled to localhost or isolated management VLANs are not exploitable from general network segments. Versions 1.2r0.0 and later are not affected.

The CVSS 4.0 base score of 5.3 (Medium) reflects a bounded real-world risk profile. Key signals: PR:L requires an authenticated session, which reduces opportunistic mass exploitation; VC:L and VI:L indicate limited confidentiality and integrity impact to the vulnerable system itself; VA:N confirms no availability impact. SC/SI/SA are all N, indicating the CVSS assessment treats subsequent-system impact as negligible, though in practice DOM XSS can facilitate session hijacking against other authenticated users. No CISA KEV listing and no known public exploit code corroborate a medium rather than critical priority. EPSS data was not provided in source intelligence; absence of this signal means exploitation probability cannot be quantitatively stated. The device class - a GNSS time server used in OT/ICS environments - warrants attention disproportionate to the raw score, as administrative-session compromise on a time server could affect NTP-dependent systems. The network attack vector (AV:N) is the primary risk amplifier; if management interfaces are internet-exposed, urgency increases substantially.

An attacker with low-privilege authenticated access to the GridTime 3000 web interface crafts a malicious payload and submits it through the password reset form; the DOM processes and renders the unsanitized input. When a higher-privileged administrator subsequently loads the affected page, the injected script executes in their browser context, potentially exfiltrating session tokens or performing privileged actions on the device. No public exploit code has been identified at time of analysis, so exploitation currently requires manual crafting of XSS payloads.