BDCOM P3310D Cross-Site Scripting Vulnerability in rmon event Tab

A cross-site scripting (XSS) vulnerability has been identified in the BDCOM P3310D management application, specifically in version 0.4.2 10.1.0F Build 86345. The issue arises within the 'rmon event' tab, where user input in the 'Description' field is not properly sanitized before being displayed. This flaw allows remote attackers to inject malicious scripts that could be executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, access the 'remote monitor' section of the BDCOM P3310D management application. Navigate to the 'rmon config' submenu and select the 'rmon event' tab. In the function to add a 'new' event, insert a payload, such as an image tag with an 'onerror' event, into the 'Description' field. This will trigger the cross-site scripting vulnerability by executing the injected script.