The vulnerability allows an attacker to embed and execute arbitrary JavaScript in the victim’s web browser when using the Kieback & Peter DDC building controller web interface. By exploiting this cross‑site scripting flaw, an attacker can gain full control of the browser session, enabling actions such as session hijacking, data exfiltration, or further lateral movement. The flaw is a classic input‑validation weakness defined as CWE‑79, leading to lost confidentiality and integrity of sensitive information accessed through the affected browsers.

Affected products include Kieback & Peter: DDC4002, DDC4002e, DDC4020e, DDC4040e, DDC4100, DDC4200, DDC4200‑L, DDC4200e, DDC4400, DDC4400e, and DDC520. Firmware update guidance is provided for several models: DDC4002e, DDC4200e, DDC4400e, DDC4020e, and DDC4040e should be upgraded to version 1.23.5 or newer, while DDC520 should be updated to version 1.24.2 or newer. Devices lacking an available firmware fix (e.g., DDC4002, DDC4100, DDC4200, DDC4200‑L, DDC4400) remain end‑of‑maintenance and must be physically isolated and have their web portals disabled if not needed.

The CVSS score of 5.3 indicates a moderate severity risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet. However, if the control’s web portal is exposed to an external network or accessed by untrusted users, the XSS flaw could be readily triggered, making the risk higher in such environments. Attackers would typically target the device’s HTTP interface from a user’s browser, exploiting reflected input to inject malicious scripts.