The reported vulnerability resides in the New RMON Statistics Page of BDCOM P3310D. By supplying a crafted value for the Owner argument, an attacker can inject arbitrary script into the page. This cross‑site scripting fault allows execution of malicious JavaScript in the context of any user who views the page, enabling session hijacking, cookie theft, or defacement. The weakness is classified as CWE‑79 and CWE‑94.

The affected vendor is BDCOM, product P3310D, versions including 0.4.2 10.1.0F Build 86345. Earlier or later build numbers are not explicitly enumerated in the advisory, so all releases around that build should be considered potentially vulnerable until a vendor update is released.

The CVSS base score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a low chance of exploitation currently. The vulnerability is not listed in CISA KEV, implying no known widespread attacks as of now. The attack vector is remote, relying on access to the P3310D web interface; a public or unprotected instance presents a higher risk. Once exploited, an attacker can inject client‑side code but the vulnerability does not grant direct control over the host.