This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the OPC XML-DA server statistics component of Loytec LIP-ME20xC and related products. Specifically, the User-Agent header in a POST /da request is not properly sanitized, allowing stored cross-site scripting. An unauthenticated attacker can inject malicious JavaScript that executes in the context of an administrator's browser, potentially leading to session hijacking, credential theft, or device reconfiguration. The affected products include LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through version 8.4.16 on LINX-A64. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser, which can lead to session hijacking, theft of credentials, and unauthorized reconfiguration of the affected device. This compromises the confidentiality, integrity, and availability of the device and its management interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected management interfaces to trusted administrators only and monitor for suspicious POST /da requests with unusual User-Agent headers. Avoid exposing these devices directly to untrusted networks.