Prolink 4G LTE Mobile Wi-Fi DL-7203E Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Prolink 4G LTE Mobile Wi-Fi DL-7203E device, specifically in version V4.0.0B05. The issue occurs in the /reqproc/proc_get endpoint, where the cmd parameter fails to properly sanitize input. As a result, injected JavaScript code can be executed by the browser, since the response is delivered with a Content-Type of text/html.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.