CVE-2026-4293 is a CWE-79 cross-site scripting vulnerability affecting Kieback & Peter DDC4002 building controllers. The vulnerability allows an attacker to inject malicious JavaScript code that executes in the context of the victim's browser when interacting with the affected device's web interface. This can lead to attacker control over the browser session. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity.

Successful exploitation enables an attacker to execute arbitrary JavaScript in the victim's browser, potentially allowing manipulation of browser behavior or unauthorized actions within the web interface. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when accessing the affected device's web interface and consider limiting access to trusted users only. Monitor vendor communications for updates on patches or mitigations.