The vulnerability resides in the New RMON History component of BDCOM P3310D firmware. Manipulation of the 'Owner' parameter allows an attacker to inject arbitrary scripts into the response. This can lead to client‑side code execution, which may compromise user sessions, steal credentials, or perform other malicious actions on the victim's browser. The attack requires sending a crafted request containing the malicious payload to the affected page, which is reachable remotely.

Affected firmware is BDCOM P3310D version 0.4.2 10.1.0F Build 86345. No other versions are listed in the advisory. The vulnerability is specific to the New RMON History Page component.

The CVSS base score of 4.8 indicates moderate severity. The EPSS value of < 1% suggests a very low probability of exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. However, the exploit was publicly disclosed and could be used by adversaries who can reach the device from the network. Because the attack vector is remote, the main prerequisite is network access to the device’s management interface. No authentication requirement is stated, so it is likely that the page is publicly accessible, increasing the overall risk.