CVE-2025-60969 is a directory traversal vulnerability affecting the EndRun Technologies Sonoma D12 Network Time Server firmware version 4.00. The vulnerability allows an attacker with network access and low privileges, requiring user interaction, to read sensitive information by traversing directories outside the intended scope. The CVSS 3.1 base score is 5.7 (medium), with a vector indicating network attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, and high confidentiality impact without integrity or availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information stored on the affected device. There is no impact on data integrity or system availability. The vulnerability requires user interaction and low privileges, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the device management interface and limit user privileges to mitigate risk.