A cross‑site scripting flaw exists in the Log Record Function of iotgateway version 3.0.1. The flaw allows an attacker to inject malicious scripts that are executed in the context of the application, effectively giving the attacker the ability to run arbitrary code on the server. The weakness is a classic input validation flaw identified by CWE‑79, and it can be leveraged to compromise confidentiality, integrity, and availability of the affected system.

The only system explicitly identified in the advisory is the iotgateway application, version 3.0.1. No additional vendor or product information is provided.

The CVSS score is 6.1, indicating moderate severity. The lack of an EPSS score and absence from the CISA KEV catalog suggest that exploitation activity has not yet been observed or quantified. Nevertheless, because the vulnerability permits remote code execution, the risk is high. Inferred attack vectors include unsanitized input from the web interface that feeds the Log Record Function; an attacker does not need privileged access to exploit the flaw.