BDCOM P3310D CVE-2026-6996

High-privilege authentication is mandatory-attacker must possess valid administrator credentials for the BDCOM P3310D device (PR:H). Second, user interaction required-the injected payload does not execute until another authenticated administrator accesses and renders the rmon event Tab configuration page containing the poisoned Description field. The Description parameter field in the rmon event Tab component must accept and store unsanitized user input without output encoding. No special network conditions or non-default configurations are required; the vulnerability exists in the default administrative interface. External unauthenticated attackers cannot reach the vulnerable component; access is limited to users with administrator-level access to the P3310D management interface, typically only available from internal management networks or VPN access.

CVSS score of 2.4 with AV:N/AC:L/PR:H/UI:R reflects a low-severity vulnerability constrained by two critical factors: (1) PR:H requires high-privilege authentication (administrator level), eliminating unauthenticated remote exploitation, and (2) UI:R mandates user interaction (an admin must view the poisoned rmon event configuration). EPSS data is unavailable for this CVE, preventing probabilistic exploitation scoring. The E:P vector indicates proof-of-concept code exists publicly, confirming technical feasibility but not active mass exploitation. The vendor's non-response to early disclosure (RL:X) suggests no official patch is forthcoming. In practice, risk is confined to insider threats or compromised administrator accounts within organizations using P3310D; external attackers cannot exploit this without first compromising administrative credentials. This is not a network-reachable remote code execution but rather a low-risk web application flaw affecting a niche network device platform.

An attacker who has already compromised or obtained administrative credentials for a BDCOM P3310D device logs into the web interface, navigates to the rmon event Tab, and injects JavaScript into the Description field of an event configuration (e.g., '<img src=x onerror="alert(1)" />'). When another administrator views the poisoned configuration, the injected script executes in their browser session, potentially stealing session tokens, redirecting them to a phishing site, or modifying network configurations. Public proof-of-concept code is available, making replication trivial for attackers who possess admin credentials.