CVE-2026-6996
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross-site scripting weakness was identified in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) affecting an unknown function of the rmon event Tab component. Manipulating the Description argument can lead to script injection. The attack can be launched remotely and a public exploit is available.
Risk Assessment
An attacker could remotely inject a malicious script that executes in the browser of an administrator or user of the device panel, potentially leading to session or data theft. The vendor did not respond to the disclosure, so a fix may not be available.
Recommendation
Restrict access to the device management interface to trusted networks, enforce input validation and output encoding, and monitor traffic for XSS attempts. Contact the vendor regarding update availability.
Other vulnerabilities in BDCOM P3310D
See all- CVE-2026-6998Low
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It affects an unknown function of the New RMON Statistics Page component. Manipulation of the Owner argument results in cross site scripting, and the attack can be executed remotely.
- CVE-2026-6997Low
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It impacts an unknown function of the New RMON History Page component. Manipulation of the Owner argument leads to cross site scripting, and remote exploitation is possible.
- CVE-2026-6995Low
A cross-site scripting flaw was discovered in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) in an unknown function of /index.asp within the New User Page component. Manipulating the User name argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Original NVD description (English source)
A weakness has been identified in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This affects an unknown function of the component rmon event Tab. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS