Jay Turla

Successful exploitation of the issue could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffic, potentially leading to session hijacking and denial-of-service (DoS).

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a stored cross-site scripting vulnerability. Successful exploitation could allow an attacker to inject malicious scripts into device fields and execute them in other users' browsers, potentially leading to session hijacking, defacement, credential theft, or privilege escalation. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs. This could potentially allow remote control of the relay channel, leading to operational or safety risks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an object injection vulnerability.