OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.
References
| Link | Resource |
|---|---|
| http://endrun.com | Broken Link |
| http://sonoma.com | Not Applicable |
| https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12 | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
10 Oct 2025, 16:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://endrun.com - Broken Link | |
| References | () http://sonoma.com - Not Applicable | |
| References | () https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12 - Third Party Advisory | |
| First Time |
Endruntechnologies
Endruntechnologies sonoma D12 Endruntechnologies sonoma D12 Firmware |
|
| CPE | cpe:2.3:o:endruntechnologies:sonoma_d12_firmware:6010-0071-000:*:*:*:*:*:*:* cpe:2.3:h:endruntechnologies:sonoma_d12:4.00:*:*:*:*:*:*:* |
06 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
06 Oct 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-06 17:16
Updated : 2025-10-10 16:35
NVD link : CVE-2025-60960
Mitre link : CVE-2025-60960
CVE.ORG link : CVE-2025-60960
JSON object : View
Products Affected
endruntechnologies
- sonoma_d12_firmware
- sonoma_d12
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')