This vulnerability affects BDCOM P3310D version 0.4.2 10.1.0F Build 86345. It is caused by insufficient input validation on the 'Owner' parameter within the New RMON Statistics Page, leading to cross-site scripting (CWE-79) and potentially code injection issues (CWE-94). The attack vector is network-based with no privileges required but user interaction is needed. The CVSS 4.0 base score is 4.8 (medium), reflecting the attack complexity and impact on confidentiality and integrity at a low level. The vendor has not issued any patch or advisory, and the exploit is publicly available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected device's web interface, potentially leading to session hijacking, defacement, or other client-side attacks. The impact on the device's confidentiality and integrity is low, and availability is not affected. No known exploitation in the wild has been reported as of the publication date.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is released, restricting access to the device's management interface to trusted networks and users can reduce exposure. Consider implementing web application firewalls or input validation proxies if feasible.