The vulnerability resides in the Audit Logs component of Crafty Controller, where HTTP headers such as X‑Real‑IP or X‑Forwarded‑For are not properly encoded before being stored. An attacker can inject malicious content into these headers, which the application then persists in the logs. When an administrator opens the audit logs, the unsanitized data is rendered, enabling stored cross‑site scripting that can steal credentials, deface the interface, or run arbitrary code under the victim’s session.

All installations of Arcadia Technology, LLC’s Crafty Controller running any version earlier than 4.11.0 are affected. No specific minor revision numbers are listed, so any unpatched deployment in that version range remains vulnerable.

The CVSS score of 9.6 reflects high severity, and the flaw is a classic XSS weakness (CWE‑116). Exploitation requires no authentication and can be carried out by sending a crafted HTTP request to the server. The EPSS score is not available. Because the vulnerability is stored and delivered to privileged users when viewing audit logs, the potential impact is significant. The vulnerability is not listed in CISA KEV at this time.