CVE-2025-60961 is a Cross Site Scripting (XSS) vulnerability in the EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware version 4.00. The vulnerability allows remote attackers to execute scripts in the context of the affected device's web interface, potentially leading to disclosure of sensitive information and other impacts. The CVSS 3.1 base score is 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No known exploits are reported in the wild and no patch or remediation information is currently available.

Successful exploitation of this XSS vulnerability can lead to disclosure of sensitive information and may allow attackers to perform actions with the privileges of the user interacting with the device's web interface. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the device's web interface and avoid clicking on untrusted links or inputting untrusted data. Monitor vendor channels for updates regarding patches or mitigations.