The GridTime 3000 GNSS Time Server contains a CWE‑601 open redirect flaw in its password change form submission. An attacker can supply a crafted redirectUrl parameter that will cause the server to redirect a user’s browser to an arbitrary, potentially malicious site. This does not provide direct code execution or data disclosure, but it enables phishing or credential‑stealing attacks by luring users to spoofed interfaces.

The flaw affects Microchip GridTime 3000 GNSS Time Server firmware versions 1.0r0.03 through 1.1r0.0 inclusive. Newer firmware starting from 1.2r0.0 has improved parameter sanitization that validates redirectUrl before execution.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to trick a legitimate user into submitting the password change form, or to have access to the web interface. Once the redirectUrl is set, the user’s browser is automatically redirected to the attacker‑controlled site. The lack of a formally published exploit may reduce immediate risk, but the possible phishing impact justifies prompt remediation.