A cross‑site scripting flaw allows an attacker to inject arbitrary JavaScript that runs in the context of any logged‑in user’s browser that accesses the Contec ECE1000 series web interface. The injected code executes with the privileges of the user, enabling manipulation of user data or covert data exfiltration while the victim is authenticated.

Contec Co., Ltd. ECE1000, ECE1020, and ECS1020 devices are affected. No specific firmware or software version numbers are disclosed, so all devices in the ECE1000 series that expose the vulnerable web interface are potentially impacted.

The CVSS score of 4.8 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed exploitation yet. The, requiring the victim to be logged into the device’s interface; an attacker who can inject malicious content through vulnerable input fields can execute code within the victim’s browser session.