A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `sessionToken` parameter of multiple methods in the "Simple HTTP API". The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.