The vulnerability is a stored cross‑site scripting flaw in the Add Hardware and rename device functions of the Domoticz web interface. Attackers can supply specially crafted names containing script or HTML markup that is stored and rendered without proper output encoding. When a user views the affected page, the malicious script runs in the user’s browser with the privileges of that user, enabling unauthorized actions within the user’s session context.

Any Domoticz installation running a version older than 2026.1 is affected. The flaw resides in the hardware configuration endpoint and applies to all deployments that expose the Add Hardware and rename device functionality to administrators.

The CVSS score of 4.8 indicates moderate severity, and the very low EPSS score (<1%) suggests the likelihood of exploitation is currently limited. However, because the flaw requires authenticated administrator access, any compromise of those credentials or an insider threat could allow exploitation. The vulnerability is not listed in the CISA KEV catalog, reflecting its current lack of widespread active exploitation.