CVE-2026-6997
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It impacts an unknown function of the New RMON History Page component. Manipulation of the Owner argument leads to cross site scripting, and remote exploitation is possible.
Risk Assessment
A public exploit is already available and could be used. This could lead to malicious script execution in the user's browser.
Recommendation
Apply available mitigations or upgrade to a version containing the fix once available. The vendor was contacted but did not respond.
Other vulnerabilities in BDCOM P3310D
See all- CVE-2026-6998Low
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It affects an unknown function of the New RMON Statistics Page component. Manipulation of the Owner argument results in cross site scripting, and the attack can be executed remotely.
- CVE-2026-6996Low
A cross-site scripting weakness was identified in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) affecting an unknown function of the rmon event Tab component. Manipulating the Description argument can lead to script injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-6995Low
A cross-site scripting flaw was discovered in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) in an unknown function of /index.asp within the New User Page component. Manipulating the User name argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Original NVD description (English source)
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page. The manipulation of the argument Owner leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS