CVE-2023-39678

MediumCVSS 6.1

Published: 29/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the device web interface of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.

Risk Assessment

This vulnerability could lead to user data theft or session hijacking, posing a significant security risk to the organization.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability and implement input validation in the web interface.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.