The vulnerability is a cross‑site scripting flaw in the Ethernet Configuration Page of Datacom DM4100. Manipulating the Name argument allows a remote attacker to inject and execute arbitrary script in the web interface, potentially hijacking user sessions, stealing credentials, or defacing the management portal. The weakness is reflected by CWE‑79 and CWE‑94, and an exploit that is publicly available has already been circulating. The vendor did not respond to disclosure, leaving no official fix public.

The affected device is the Datacom DM4100 running firmware 1.3.6.1.4.1.3709. No other vendors, products, or versions have been reported as impacted in the CVE record. The vulnerable component is the Ethernet Configuration Page of this firmware.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in CISA’s KEV catalog. However, the flaw is exploitable remotely via a crafted web request to the configuration interface, requiring only network connectivity to the device’s management port. If exploited, an attacker could execute scripts with the privileges of the web interface, affecting confidentiality, integrity, and availability of the device’s configuration and potentially the broader network.