This vulnerability in BDCOM P3310D 0.4.2 10.1.0F Build 86345 allows remote attackers to perform cross-site scripting via manipulation of the Description argument in the rmon event Tab component. The CVSS 4.8 (medium) score reflects network attack vector with low complexity but requiring user interaction and high privileges. The vendor has not issued a fix or advisory, and public exploit code exists. No cloud service is involved, and the vulnerability affects the specified firmware version only.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected device's web interface, potentially leading to session hijacking or other client-side attacks. However, exploitation requires user interaction and high privileges, limiting the scope of impact. No evidence of exploitation in the wild has been reported.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should monitor vendor channels for updates. Until a fix is released, restricting access to the device's management interface and limiting user privileges may reduce exposure. Avoid interacting with suspicious inputs in the affected component.