CVE-2024-26367 is a remote Cross Site Scripting (XSS) vulnerability in multiple Evertz Microsystems firmware versions. An attacker can exploit this by submitting a crafted payload to the login parameters, potentially leading to arbitrary code execution in the context of the affected application. The vulnerability impacts confidentiality and integrity but not availability, with no privileges or user interaction required beyond initiating the login request. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary code within the affected application context, potentially compromising confidentiality and integrity of the system. The vulnerability does not impact availability. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary (UI:R).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when exposing affected devices to untrusted networks and consider additional protective measures such as input validation or web application firewalls if applicable. Monitor vendor communications for updates.