CVE-2026-12620 - Vulnerability Details - OpenCVE

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microchip	Gridtime 3000

No data.

No data.

References

Link	Providers
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposure

History

Mon, 22 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 21 Jun 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microchip Microchip gridtime 3000
Vendors & Products		Microchip Microchip gridtime 3000

Fri, 19 Jun 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
Title		Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server
Weaknesses		CWE-200
References		https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposure
Metrics		cvssV4_0 `{'score': 4.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A'}`

MITRE

Status: PUBLISHED

Assigner: Microchip

Published: 2026-06-19T15:59:07.447Z

Updated: 2026-06-29T05:22:09.732Z

Reserved: 2026-06-18T14:15:03.036Z

Link: CVE-2026-12620

Vulnrichment

Updated: 2026-06-22T16:52:53.157Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12620", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "state": "PUBLISHED", "assignerShortName": "Microchip", "dateReserved": "2026-06-18T14:15:03.036Z", "datePublished": "2026-06-19T15:59:07.447Z", "dateUpdated": "2026-06-29T05:22:09.732Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-06-29T05:22:09.732Z"}, "title": "Access Token Exposure in URL Parameters in GridTime\u2122 3000 GNSS Time Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-200", "description": "CWE-200", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21"}]}], "affected": [{"vendor": "Microchip", "product": "GridTime 3000", "versions": [{"status": "affected", "version": "1.0r0.03", "lessThanOrEqual": "1.1r0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.\n\nThis issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.<p>This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.</p>"}]}], "references": [{"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposure", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "ATTACKED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A"}}], "solutions": [{"lang": "en", "value": "Upgrade GridTime 3000 GNSS Time Server to the latest firmware.\n\n\n\n\n\nAs of the firmware release 1.2r0.0, Access tokens have been removed from URL parameters on affected endpoints.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>\nUpgrade GridTime 3000 GNSS Time Server to the latest firmware.</div><div><br></div><div>\nAs of the firmware release 1.2r0.0, Access tokens have been removed from URL parameters on affected endpoints.\n\n</div>"}]}], "credits": [{"lang": "en", "value": "Leo Angelo Diamat (Bastion Security Group)", "type": "reporter"}], "source": {"advisory": "PSIRT-145", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T16:52:29.215328Z", "id": "CVE-2026-12620", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:14:15.852Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12620", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T16:52:29.215328Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T16:52:53.157Z"}}], "cna": {"title": "Access Token Exposure in URL Parameters in GridTime\u2122 3000 GNSS Time Server", "source": {"advisory": "PSIRT-145", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Leo Angelo Diamat (Bastion Security Group)"}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A", "exploitMaturity": "ATTACKED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Microchip", "product": "GridTime 3000", "versions": [{"status": "affected", "version": "1.0r0.03", "versionType": "custom", "lessThanOrEqual": "1.1r0.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade GridTime 3000 GNSS Time Server to the latest firmware.\n\n\n\n\n\nAs of the firmware release 1.2r0.0, Access tokens have been removed from URL parameters on affected endpoints.", "supportingMedia": [{"type": "text/html", "value": "<div>\nUpgrade GridTime 3000 GNSS Time Server to the latest firmware.</div><div><br></div><div>\nAs of the firmware release 1.2r0.0, Access tokens have been removed from URL parameters on affected endpoints.\n\n</div>", "base64": false}]}], "references": [{"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposure", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.\n\nThis issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.", "supportingMedia": [{"type": "text/html", "value": "The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.<p>This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200"}]}], "providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-06-29T05:22:09.732Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12620", "state": "PUBLISHED", "dateUpdated": "2026-06-29T05:22:09.732Z", "dateReserved": "2026-06-18T14:15:03.036Z", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "datePublished": "2026-06-19T15:59:07.447Z", "assignerShortName": "Microchip"}, "dataVersion": "5.2"}