A flaw in the web-based management interface allows an unauthenticated remote attacker on the same local network to execute arbitrary JavaScript code in a victim's browser. This could lead to the compromise of user data and the potential manipulation of device configuration settings.