The vulnerability is a stored cross‑site scripting flaw, meaning user‑supplied data written to the database is later rendered without proper neutralization. This allows an attacker to inject JavaScript that executes in the browsers of any users who view the affected page. When executed, the script can steal session cookies, perform actions on behalf of the user, or redirect the user to malicious sites. The weakness is classified as CWE‑79.

ABB T‑MAC Plus is affected, specifically versions from 4.0 up to 24. No other products or vendor versions are listed as impacted in the data.

The CVSS score of 7.2 indicates a high potential for significant impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so the public exploitation window is uncertain. The likely attack vector is via the web management interface where malicious input can be stored and later rendered. An attacker would need to supply malicious input, which may be possible if authentication controls or input validation are weak in the application. The lack of an EPSS score makes it difficult to gauge present threat, but the high CVSS suggests that if exploited, the damage could be substantial to any compromised user session.