EUVD-2026-38040
GHSA-pqrf-vgj8-cvrm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web UI, low-privilege auth required, and XSS impact requires a victim user to load the poisoned page (UI:R), with scope change to victim's browser context (S:C).
Primary rating from Vendor (Microchip).
CVSS VectorVendor: Microchip
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.
AnalysisAI
DOM-based cross-site scripting in Microchip's GridTime 3000 GNSS Time Server allows an authenticated attacker to inject malicious JavaScript through the device's password reset form, executing arbitrary script in the browser context of any user who subsequently loads the affected page. The vulnerability spans versions 1.0r0.03 through all releases before 1.2r0.0. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis; however, the network-accessible web interface and low-privilege authentication requirement make this exploitable in typical enterprise or utility network deployments where the device's management UI is reachable.
Technical ContextAI
GridTime 3000 is a GNSS-disciplined network time server produced by Microchip Technology, commonly deployed in critical infrastructure and industrial environments for precise time synchronization. The affected component is the web-based management interface's password reset form, which fails to properly neutralize user-supplied input before rendering it in the browser (CWE-79: Improper Neutralization of Input During Web Page Generation). The Microchip advisory URL explicitly identifies this as DOM XSS, meaning the vulnerable code path processes attacker-controlled data through the browser's Document Object Model without server-side sanitization. The CPE string cpe:2.3:a:microchip:gridtime_3000:*:*:*:*:*:*:*:* confirms this is an application-layer flaw in Microchip's software, not the underlying OS or firmware. CVSS 4.0 metrics AV:N/AC:L/AT:N/PR:L confirm the attack is network-accessible, low complexity, and requires low-privilege authentication with no additional attack target conditions.
RemediationAI
Upgrade GridTime 3000 firmware to version 1.2r0.0 or later, as specified by Microchip's advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-dom-xss. If immediate patching is not feasible, restrict access to the device's web management interface using firewall rules or network segmentation so that only trusted administrator workstations can reach the management port - this eliminates the network-accessible attack surface without disabling the time-synchronization service itself. Additionally, enforce a policy of logging out of management sessions immediately after use, which limits the window for session-hijacking via XSS. Note that restricting network access does not remediate the underlying flaw and should be treated as a temporary compensating control only until 1.2r0.0 is deployed.
More in Gridtime 3000
View allOpen redirect in Microchip's GridTime 3000 GNSS Time Server allows authenticated low-privilege users to manipulate the p
Cross-site scripting in Microchip GridTime 3000 GNSS Time Server (versions 1.0r0.03 through 1.1r0.0) permits authenticat
Access token exposure in Microchip's GridTime 3000 GNSS Time Server (versions 1.0r0.03 through 1.1r0.0) leaks authentica
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today