Microchip Gridtime 3000 Firmware vulnerabilities

4 CVEs affecting Microchip Gridtime 3000 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12622, published 2026-06-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12620, published 2026-06-19. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
CVE-2026-12621, published 2026-06-19. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.
CVE-2026-12619, published 2026-06-19. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This issue affects GridTime…
CVE-2026-12622, published 2026-06-19. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.