This vulnerability affects the VLAN Page functionality of Datacom DM4100 version 1.3.6.1.4.1.3709. Manipulation of the VLAN Name parameter can lead to cross-site scripting, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The CVSS 4.0 base score is 4.8, indicating medium severity, with network attack vector, low attack complexity, and requiring high privileges and user interaction. The vendor has not provided any response or patch, and no official remediation level is assigned.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts via the VLAN Name parameter, potentially leading to session hijacking or other client-side impacts. However, the vulnerability requires user interaction and high privileges, limiting its impact. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider applying compensating controls such as restricting access to the VLAN Page to trusted administrators only and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.