VulnerabilityAnalyzed

CVE-2026-12620

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.

MEDIUM 4.6EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: microchip/gridtime 3000 firmware
Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

References

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposureVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.