Cyber Posture

CVE-2025-60960

High

Published: 06 October 2025

Published
06 October 2025
Modified
10 October 2025
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS Score 0.0042 61.8th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-60960, published on 2025-10-06, is an OS Command Injection vulnerability (CWE-78) in the EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware version 6010-0071-000 Ver 4.00. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), indicating high severity due to its network accessibility and low attack complexity.

Attackers require no authentication privileges or user interaction and can exploit the vulnerability remotely over the network. Successful exploitation enables execution of arbitrary code, denial of service, escalation of privileges, and disclosure of sensitive information, with high impact on integrity and low impact on confidentiality.

Advisories providing further details, including potential mitigations, are available from EndRun Technologies at http://endrun.com and http://sonoma.com, along with a vulnerability research advisory at https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12.

Details

CWE(s)
CWE-78

Affected Products

endruntechnologies
sonoma d12 firmware
6010-0071-000

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote OS Command Injection (CWE-78) in public-facing network time server firmware directly enables exploitation of remote services (T1210), command execution via Unix Shell (T1059.004), privilege escalation (T1068), and application/system DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References