A cross‑site scripting flaw exists in the Wireless Setup Section of the D‑Link DSL‑2740R firmware version EU_01.15. By providing a crafted value for the Wireless Network Name argument, an attacker can inject arbitrary client‑side scripts. The impact is the ability to deface the web interface, steal session cookies, or execute arbitrary JavaScript in the context of an authenticated user’s browser. The vulnerability is a classic reflected XSS (CWE‑79) and also involves a code injection component (CWE‑94) where the crafted input is processed by the router’s software.

The affected product is the D‑Link DSL‑2740R router running firmware EU_01.15. Users should verify that their device matches this build before checking for a vulnerable configuration. No other versions or editions were listed as impacted.

The CVSS score of 4.8 places this issue in the moderate risk range, and the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The defect is not listed in the CISA KEV catalog. Because the attack can be performed remotely through the router’s web interface and the exploit code is publicly available, the potential impact depends on the attacker’s level of access to the router’s management console. The exploit requires the ability to submit an HTTP request to the Wireless Setup endpoint. An attacker with network access to the router’s LAN or WAN side can send the malicious payload. Once the payload is executed in a victim’s browser, it can perform phishing, data theft, or other client‑side attacks. Given the moderate CVSS score but low EPSS, the practical risk is considered moderate; however, in environments where the router’s web interface is exposed to the Internet or to untrusted networks, the threat is elevated.