CVE-2026-12620

MEDIUM

Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server

Title source: cna

Description

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-access-token-exposure

Scores

CVSS v3 6.5

EPSS 0.0023

EPSS Percentile 13.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

Microchip/GridTime 3000 1.0r0.03 - 1.1r0.0

microchip/gridtime_3000_firmware 1.0r0.03 - 1.2r0.0

Published Jun 19, 2026

Tracked Since Jun 19, 2026