Datacom DM4100 Cross-Site Scripting Vulnerability in VLAN Page Component

A cross-site scripting (XSS) vulnerability has been identified in the Datacom DM4100 management application, specifically in version 1.3.6.1.4.1.3709. The issue arises within the VLAN Page component, where the 'VLAN Name' field can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, requiring some user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the VLAN Page in the Datacom DM4100 management application. Modify the 'VLAN Name' field by injecting a script, such as an image tag with an 'onerror' event, which prompts an alert.