The vulnerability lies in the VLAN Page component of Datacom DM4100 firmware 1.3.6.1.4.1.3709, where the VLAN Name argument is not properly sanitized. Based on the description, it is inferred that this allows a remote attacker to inject arbitrary script that executes in the browser of anyone who views the affected page, enabling session hijacking, credential theft or phishing attacks. The flaw is a classic reflected XSS as documented by CWE‑79 and does not give direct code execution on the device but can be abused to compromise users.

Datacom DM4100 network switches running firmware version 1.3.6.1.4.1.3709. Earlier builds lacking the patch are also susceptible.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that, because it is reachable from remote interfaces, the attack may be performed by any unauthenticated user who can obtain the admin UI. No user‑authentication bypass is required, making it achievable without privileged access.