This vulnerability allows a remote, authenticated administrator on Digi PortServer TS and related devices to inject stored malicious scripts into system configuration fields via the web management interface. When other users view the affected pages, the injected script executes in their browsers, potentially leading to unauthorized actions or information disclosure. The issue is due to improper neutralization of input during web page generation (CWE-79). No official patch or remediation level has been provided by the vendor as of the published date.

The impact is limited to authenticated administrators who can inject malicious scripts that execute in the browsers of users viewing the affected configuration pages. This could lead to session hijacking, unauthorized actions, or information disclosure within the context of the web management interface. The vulnerability does not allow unauthenticated remote exploitation and requires user interaction (viewing the affected pages).

No official fix or patch is currently available for this vulnerability. Since exploitation requires authenticated administrator access, restricting administrative access to trusted personnel and networks is recommended. Monitor vendor advisories for updates regarding patches or official remediation guidance.