EndRun Technologies Sonoma D12 Network Time Server Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in the EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware version 6010-0076-000 Ver 4.00. This vulnerability allows attackers to inject malicious scripts, potentially leading to the disclosure of sensitive information and session hijacking.

Impact

Exploitation of this vulnerability could result in the disclosure of sensitive information and session hijacking.

Remediation

The vendor has provided interim mitigation steps to disable web-management access until an official patch is available. These steps have been verified as effective by the vendor.