EndRun Technologies Sonoma D12 Network Time Server OS Command Injection Vulnerability

A command injection vulnerability has been identified in the EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware version 6010-0071-000 v4.00. This vulnerability allows remote attackers to execute arbitrary code, escalate privileges, cause a denial-of-service condition, and access sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution, privilege escalation, and full system compromise.

Remediation

The vendor has provided interim mitigation steps to disable web-management access. These steps involve changing the permissions of the httpd management script, copying it to a backup location, and rebooting the system. This mitigation should be validated in a controlled environment before applying it in production.