EndRun Technologies Sonoma D12 Network Time Server Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in the EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware version 6010-0071-000 v4.00. This vulnerability allows attackers to inject malicious scripts that could be executed in the context of the user's browser, potentially leading to the disclosure of sensitive information or session hijacking.

Impact

Exploitation of this vulnerability could result in the disclosure of sensitive information and session hijacking.

Remediation

The vendor has provided interim mitigation steps to disable web-management access until an official patch is available. These steps involve modifying the httpd service permissions and rebooting the device. However, operational impact should be carefully evaluated before applying these steps in production environments.