CVE-2026-6998
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It affects an unknown function of the New RMON Statistics Page component. Manipulation of the Owner argument results in cross site scripting, and the attack can be executed remotely.
Risk Assessment
A public exploit is already available and could be used. This could lead to malicious script execution in the user's browser.
Recommendation
Apply available mitigations or upgrade to a version containing the fix once available. The vendor was contacted but did not respond.
Other vulnerabilities in BDCOM P3310D
See all- CVE-2026-6997Low
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It impacts an unknown function of the New RMON History Page component. Manipulation of the Owner argument leads to cross site scripting, and remote exploitation is possible.
- CVE-2026-6996Low
A cross-site scripting weakness was identified in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) affecting an unknown function of the rmon event Tab component. Manipulating the Description argument can lead to script injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-6995Low
A cross-site scripting flaw was discovered in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) in an unknown function of /index.asp within the New User Page component. Manipulating the User name argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Original NVD description (English source)
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipulation of the argument Owner results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS