This vulnerability is a reflected Cross Site Scripting (CWE-79) in CA17 TeamsACS version 1.0.1. An attacker can exploit the errmsg parameter by sending a crafted script, which is then executed in the context of the victim's browser. The CVSS vector indicates the attack is network-based, requires no privileges, but does require user interaction. The impact includes partial confidentiality and integrity loss without availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial confidentiality and integrity compromise. This could enable theft of sensitive information or manipulation of client-side data. There is no impact on system availability. The attack requires user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs, especially those involving the errmsg parameter. Implementing web application firewalls or input validation may help mitigate risk but are not confirmed fixes.