Cyber Resilience

CVE-2025-60960

HighRCE

Published: 06 October 2025

Published
06 October 2025
Modified
10 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS Score 0.0054 68.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60960 is a high-severity OS Command Injection (CWE-78) vulnerability in Endruntechnologies Sonoma D12 Firmware. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 32.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-60960, published on 2025-10-06, is an OS Command Injection vulnerability (CWE-78) in the EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware version 6010-0071-000 Ver 4.00. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), indicating high severity due to its network accessibility and low attack complexity.

Attackers require no authentication privileges or user interaction and can exploit the vulnerability remotely over the network. Successful exploitation enables execution of arbitrary code, denial of service, escalation of privileges, and disclosure of sensitive information, with high impact on integrity and low impact on confidentiality.

Advisories providing further details, including potential mitigations, are available from EndRun Technologies at http://endrun.com and http://sonoma.com, along with a vulnerability research advisory at https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12.

EU & UK References

Vulnerability details

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote OS Command Injection (CWE-78) in public-facing network time server firmware directly enables exploitation of remote services (T1210), command execution via Unix Shell (T1059.004), privilege escalation (T1068), and application/system DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-60964Same product: Endruntechnologies Sonoma D12
CVE-2025-60965Same product: Endruntechnologies Sonoma D12
CVE-2025-60957Same product: Endruntechnologies Sonoma D12
CVE-2025-60959Same product: Endruntechnologies Sonoma D12
CVE-2025-60963Same product: Endruntechnologies Sonoma D12
CVE-2025-60962Same product: Endruntechnologies Sonoma D12
CVE-2021-47745Shared CWE-78
CVE-2026-34005Shared CWE-78
CVE-2021-47747Shared CWE-78
CVE-2026-34792Shared CWE-78

Affected Assets

endruntechnologies
sonoma d12 firmware
6010-0071-000

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates OS command injection by validating inputs to prevent attackers from injecting arbitrary commands into the vulnerable firmware interface.

SI-9 Information Input Restrictions good match
prevent

Restricts classes of inputs and commands to block malicious payloads that exploit the command injection vulnerability in the network time server.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific firmware flaw through identification, testing, and installation of patches for CVE-2025-60960.

References