The vulnerability is a reflected cross‑site scripting flaw that allows arbitrary JavaScript to run in a logged‑in user's browser when they visit a specially crafted page. The description does not specify additional consequences beyond the execution of that script in the browser context.

The flaw exists in the SD‑330AC and AMC Manager appliances from silex technology, Inc. No specific vulnerable version ranges are publicly disclosed, so all deployed units should be considered at risk until a vendor patch is applied.

The CVSS v3.1 score of 5.1 indicates moderate severity, and the EPSS score is not available, so we cannot quantify current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need a legitimate authenticated user who has accessed the device to load a crafted URL; once loaded, the injected script runs in the context of that user's browser, exploiting trust in the device’s UI.