Rejetto HFS versions 3.0.0 through 3.2.0 improperly neutralize input during web page generation in the administration panel by rendering log entries as HTML without sanitization. This allows a remote unauthenticated attacker to submit a failed login with a specially crafted username that is recorded in the error log. When an administrator views these logs, the malicious JavaScript executes in their browser context, enabling the attacker to create accounts or execute code on the server with administrator privileges. No official patch or remediation level has been provided in the available data.

An attacker can remotely inject JavaScript into the administration panel logs without authentication. This script executes in the administrator's browser, potentially allowing the attacker to create new accounts or execute arbitrary code on the server with administrator privileges. This compromises the confidentiality, integrity, and availability of the system under administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid viewing untrusted log entries or restrict access to the administration panel to trusted users only. Implementing additional input sanitization or filtering on log data may help mitigate risk.