GridTime 3000 GNSS Time Server versions 1.0r0.03 through 1.1r0.0 inadvertently expose the access token in the URI query string of certain endpoints. The leakage lets an attacker acquire the token, which can be used to authenticate to the device and gain unauthorized access, thereby compromising confidentiality and integrity. The flaw is an information‑disclosure vulnerability (CWE‑200).

The affected devices are Microchip GridTime 3000 GNSS Time Servers running firmware versions 1.0r0.03 up to and including 1.1r0.0. Firmware 1.2r0.0 and later have removed the token from URL parameters.

The CVSS score of 4.6 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at present. Exploitation likely requires network connectivity to the device and the ability to observe or capture the request URLs – for example, via traffic monitoring, log inspection, or direct interaction with the affected endpoints. Successful discovery of the token would permit the attacker to authenticate and potentially access restricted functionality.