This vulnerability (CWE-79) involves improper neutralization of input during web page generation in the Advantech EKI-1242IEIMS device's Modbus transaction management interface. An authenticated remote attacker can inject and store malicious scripts that execute in the context of an administrator's browser upon viewing the compromised management page. This could lead to limited confidentiality and integrity impacts as indicated by the CVSS vector, but no direct availability or privilege escalation impact is noted.

The vulnerability allows remote authenticated attackers to perform stored cross-site scripting attacks against administrators accessing the affected interface. This can result in execution of arbitrary scripts in the administrator's browser, potentially leading to session hijacking or unauthorized actions within the management interface. The impact is limited to confidentiality and integrity with no direct availability impact reported.

No vendor advisory or patch information is provided for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the management interface to trusted administrators and consider additional protections such as web application firewalls or input validation controls if feasible.