D-Link DSL-6641K Cross-Site Scripting Vulnerability in Web Interface

A stored cross-site scripting vulnerability has been identified in the D-Link DSL-6641K router, specifically in the N8.TR069.20131126 version. The issue arises in the web interface function 'ad_virtual_server_vdsl', where user input in the 'Name' field is not properly sanitized before being saved in the router's configuration. This flaw allows attackers to inject malicious JavaScript that is executed when the configuration page is viewed, potentially leading to session hijacking, credential theft, or unauthorized actions on the web interface.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.