The flaw allows attackers to inject malicious scripts that are stored on the device, executing in the browsers of administrators or users when they view affected pages. This fault stems from insufficient input sanitization in certain functional modules, enabling persistent client‑side code execution and compromising confidentiality, integrity, and availability of the system as viewed by the user.

CP Plus devices in the 1xxx series, specifically the CP‑UNR‑108F1 hardware, system and web components. No version ranges are specified in the vendor notes.

The CVSS score of 8.4 classifies the issue as High severity. Though EPSS data is not provided, the lack of a CISA KEV listing suggests limited but possible exploitation risk. Based on the description, it is inferred that attackers would target the device’s web interface, submitting crafted input that is later rendered and executed when an authenticated user accesses the affected page. The likely attack vector is the web interface, and given its persistent storage nature, any logged‑in user would be affected.