GridTime 3000 EUVD-2026-38038

Exploitation requires that the attacker possesses a valid low-privilege authenticated account on the GridTime 3000 web management interface (PR:L per CVSS 4.0). A higher-privileged user - such as an administrator - must be authenticated to the device and passively interact with an attacker-controlled resource, such as visiting a malicious page or following a crafted link (UI:P). The attack is delivered over the network (AV:N), so the device's web interface must be reachable from the attacker's network position. The CSRF-to-XSS chain as named in the vendor advisory is the specific attack path: exploitation is not direct XSS injection but requires the CSRF step to deliver the payload. Exploitation is limited by: the requirement for the attacker to hold any valid device credential; the requirement that a privileged user take passive action (visit a crafted URL) while authenticated; and the low confidentiality impact on the server itself (VC:N), meaning session token theft targets the victim's browser context rather than the server's data store directly. Unauthenticated external attackers with no device credentials cannot initiate exploitation.

The CVSS 4.0 base score of 5.1 (Medium) reflects network accessibility (AV:N), low complexity (AC:L), a low-privilege prerequisite (PR:L), and passive user interaction (UI:P), with integrity and availability impacts rated low on the vulnerable system (VI:L/VA:L) and no impact on subsequent systems (SC:N/SI:N/SA:N). The single most important risk escalator here is the E:A (Attacked) Threat metric within the provided CVSS 4.0 vector, which in CVSS 4.0 terminology means exploitation in the wild has been reported - this elevates operational priority significantly. No explicit CISA KEV listing or EPSS score appears in the provided data, so active exploitation is vendor-asserted rather than independently confirmed through a secondary authoritative source. The CSRF-to-XSS delivery chain adds attack complexity in practice but is a well-documented, tooled technique; the low-privilege requirement means any device account holder is a potential threat actor. The GridTime 3000's role in network time synchronization means that admin-session hijacking through XSS could enable configuration tampering with downstream effects on NTP-dependent infrastructure. Overall: moderate base score, but active exploitation signal and critical-infrastructure context warrant accelerated remediation.

An attacker who has obtained a low-privilege account on the GridTime 3000 web interface crafts a CSRF request that, when an authenticated administrator visits a malicious external page or link, fires against the device and triggers execution of attacker-controlled JavaScript within the administrator's browser session against the device UI. The CVSS 4.0 E:A metric indicates this type of exploitation has been reported in the wild. Successful exploitation grants the attacker the ability to perform administrative actions, steal session tokens, or modify device configuration under the guise of the authenticated admin.