CVE-2026-12620

Published: Jun 19, 2026Modified: Jul 9, 2026

4.6

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5 (Secondary)

Description

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

Affected (1)

Products: Microchip: Gridtime 3000 Firmware

1 product

Gridtime 3000 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microchip Gridtime 3000 Firmware	From 1.0r0.03 to 1.2r0.0

Running on/with	Platform Versions
Microchip Gridtime 3000	All versions

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposure

Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Vendor Advisory

Timeline

No history available yet.