CVE-2026-6995
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross-site scripting flaw was discovered in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) in an unknown function of /index.asp within the New User Page component. Manipulating the User name argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Risk Assessment
A remote attacker could execute a malicious script in the victim's browser context, risking session hijacking or data disclosure. The vendor's lack of response means a patch may not be available.
Recommendation
Restrict access to the device panel, enforce input validation and output encoding, and monitor for XSS attempts. Request update information from the vendor.
Other vulnerabilities in BDCOM P3310D
See all- CVE-2026-6998Low
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It affects an unknown function of the New RMON Statistics Page component. Manipulation of the Owner argument results in cross site scripting, and the attack can be executed remotely.
- CVE-2026-6997Low
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It impacts an unknown function of the New RMON History Page component. Manipulation of the Owner argument leads to cross site scripting, and remote exploitation is possible.
- CVE-2026-6996Low
A cross-site scripting weakness was identified in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) affecting an unknown function of the rmon event Tab component. Manipulating the Description argument can lead to script injection. The attack can be launched remotely and a public exploit is available.
Original NVD description (English source)
A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345. The impacted element is an unknown function of the file /index.asp of the component New User Page. Performing a manipulation of the argument User name results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS