This vulnerability (CVE-2024-6920) in NACPremium is a stored Cross-site Scripting (CWE-79) flaw caused by improper input neutralization during web page generation. It allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can be executed in the context of other users viewing the affected pages. The CVSS 4.0 base score is 4.8 (medium), reflecting network attack vector, low complexity, and limited impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by NAC Telecommunication Systems Inc. as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the vulnerability requires user interaction and low privileges, and its overall impact is limited as reflected by the medium CVSS score. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor vendor communications for updates on patches or official mitigations.