GridTime 3000 EUVD-2026-38039

Exploitation requires a valid low-privilege authenticated session on the GridTime 3000 web management interface, as confirmed by the CVSS 4.0 PR:L metric - unauthenticated remote attackers cannot exploit this directly. The vulnerable code path is specifically the password change form submission handler, which must be reachable over the network (AV:N). No additional special configuration beyond default deployment of the affected firmware versions is required. Exploitation is bounded by the authentication prerequisite and is most impactful when the attacker can deliver a crafted link to a human operator who interacts with the management interface, enabling a phishing outcome. Deployments where the web management interface is firewalled to a dedicated management VLAN with strict access control significantly reduce exposure.

The vendor-assigned CVSS 4.0 score of 5.3 (Medium) accurately reflects the constrained impact: limited confidentiality and integrity effects (VC:L/VI:L) with no availability impact (VA:N/SC:N/SI:N/SA:N). The PR:L metric is the primary limiting factor - exploitation requires prior authentication to the web management interface, ruling out opportunistic unauthenticated attacks. No EPSS score was supplied in the available data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. The risk is elevated in OT/ICS deployment contexts typical of GNSS time servers: administrators accessing the management interface from trusted internal networks may have lower phishing-skepticism thresholds when a redirect originates from a known device hostname. No public exploit code has been identified, keeping real-world exploitation probability low in the near term. Overall this is a legitimate but lower-priority remediation item - real priority in environments where the management interface is exposed to a broader user population or where credential reuse is a concern.

An attacker with low-privilege credentials to the GridTime 3000 management interface crafts a password change form submission URL embedding a malicious redirect parameter pointing to an attacker-controlled site mimicking the device login page. After the form is submitted, the server issues a redirect to the attacker's site, where the victim administrator's credentials are harvested. No public exploit code is currently known, and the attack is most effective when combined with social engineering to deliver the crafted link to a legitimate administrator.