CVE-2025-60960 describes an OS Command Injection vulnerability (CWE-78) in the EndRun Technologies Sonoma D12 Network Time Server firmware version 4.00. This vulnerability enables remote attackers to execute arbitrary commands on the affected device without privileges or user interaction. The impact includes potential code execution, denial of service, privilege escalation, and information disclosure. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity with limited impact on confidentiality and availability. No patch or remediation information is currently available, and no known exploits have been reported in the wild.

Successful exploitation could allow attackers to execute arbitrary code on the device, disrupt its operation causing denial of service, escalate their privileges, and access sensitive information stored or processed by the device. This could compromise the integrity and confidentiality of the network time server and potentially affect dependent systems relying on accurate time synchronization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device to trusted administrators only and monitor for unusual activity. Avoid exposing the device directly to untrusted networks.