GridTime 3000 EUVD-2026-38038

Consult the Microchip vendor advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-csrf-to-xss for firmware patch availability; no specific patched firmware version number is confirmed in the currently available data, so the advisory is the authoritative source for the exact fix version. Given the E:A active exploitation signal, firmware update should be treated as urgent once available. As compensating controls pending patch application: restrict network access to the GridTime 3000 web management interface to only trusted administrator hosts using firewall rules or VLAN segmentation - this breaks the AV:N delivery path and substantially reduces exploitability. If web management is not operationally required, disable it entirely on the device. Administrators should avoid clicking untrusted links and avoid browsing other sites while authenticated to the device interface, since the CSRF component of the attack chain requires passive interaction from an authenticated privileged session. Note that network restriction does not remediate the underlying XSS flaw and should be treated as a temporary measure only.