CVE-2012-5053: Cross-site scripting (XSS) vulnerability in the Receiver Web User Interface on Trimble Infrastructure GNSS...

Security readout for executives and security teams

This CVE describes a cross-site scripting issue in the web management interface of several Trimble GNSS receivers. If an attacker can reach that interface and trigger the unspecified vulnerable path, they may run script in a user’s browser session. Business urgency depends mainly on whether these receiver web interfaces are exposed beyond trusted administrators. Exposure is most likely in environments operating the listed Trimble Infrastructure GNSS receivers with enabled web administration on affected firmware. Internet-facing, shared, or weakly segmented management interfaces raise risk. Systems already updated to the referenced fixed releases are not indicated as affected by the CVE description. Prioritize if these receivers support critical positioning, timing, or infrastructure workflows and their web interfaces are reachable outside restricted administrator networks. Without evidence of active exploitation or severity scoring, urgency is driven by exposure and operational importance rather than public exploit pressure. Mitigation focus: Upgrade NetR3, NetR5, NetR8, and NetR9 receivers to firmware 4.70 where applicable.; Upgrade NetRS receivers to firmware 1.3-2 where applicable.; Restrict receiver web interfaces to trusted administration networks only..

Prepared

Jun 15, 2026, 04:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.