This vulnerability is a reflected cross-site scripting (CWE-79) issue affecting the Admin Login page of Allworx System Software v9.1.9.12. An attacker can inject malicious scripts through the SessionID parameter in query.asp, which is not properly sanitized. The CVSS v3.1 base score is 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable web application, potentially leading to theft of sensitive information, session hijacking, or manipulation of the user interface. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and does not require privileges, increasing the risk in scenarios where users access the affected login page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the SessionID parameter. Additionally, users should be cautious when interacting with links to the affected login page. Monitor vendor communications for updates on patches or official mitigations.