A cross‑site scripting flaw exists in the settings page of TOA Corporation’s TRIFORA 3 series network cameras. When an administrator supplies malicious input during configuration, the browser rendering the admin interface can execute client‑side code. This allows arbitrary script execution in the context of the administrative user’s browser. The weakness maps to CWE‑79.

The vulnerability affects the TRIFORA 3 series cameras from TOA Corporation. No specific firmware or version numbers are listed in the advisory, so any device running the current software identified as TRIFORA 3 is potentially exposed.

The CVSS base score of 4.8 classifies the flaw as medium severity. The EPSS score of less than 1% indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have administrative access to the camera and be able to supply malicious input into the configuration interface, which limits the attack vector and reduces the likelihood of widespread impact.