A flaw has been found in BIVOCOM TR321 firmware 21.1.1.50. The Wireless Setting component’s Network Name (SSID) argument can be manipulated, causing cross‑site scripting. This flaw can be exploited remotely, and the code to perform the attack has been published. The vulnerability permits a remote attacker to inject arbitrary scripts into the device’s web UI, potentially compromising confidentiality and integrity of the device’s configuration and session information. The weakness is rooted in improper input validation and output encoding, as identified by CWE‑79 and CWE‑94.

The vulnerability affects BIVOCOM TR321 devices running firmware 21.1.1.50, specifically the Wireless Setting feature that processes the SSID parameter. No other product versions or vendors are listed as impacted.

The CVSS rating of 4.8 places this flaw in the low‑severity range, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and the vendor has released an update that addresses this vulnerability. However, the exploit code has been published and can be used remotely by manipulating the SSID input over the wireless interface. Attackers could potentially trigger the flaw by sending crafted packets to the device, making the attack vector likely remote and network‑based.