An attacker can craft a malicious URL targeting the /logo.asp component of the FS Inc S3150‑8T2F switch. When a user visits that URL, the component echoes user input without proper sanitization, causing the browser to execute embedded JavaScript in the context of the switch’s web interface. This can lead to credential theft, session hijacking, or lateral movement within a local network. The weakness is a classic reflected cross‑site scripting flaw (CWE‑79).

The affected platform is the FS Inc S3150‑8T2F Switch running firmware 2.2.0D Build 118101. No other vendor or product versions are listed in the public data.

The CVSS score is 6.1, the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low to moderate exploitation likelihood. Nevertheless, the reflected XSS can be triggered via any user that opens the crafted URL, making it a potential threat for administrators or users who may inadvertently click malicious links from compromised internal or external sources.