CVE-2026-82488: Cross Site Scripting in Beetel 450TC3

This vulnerability in Beetel 450TC3 version 01.00.00_01 involves a cross-site scripting flaw in the User Management component. An attacker can manipulate the Username parameter to inject and execute arbitrary scripts remotely. The CVSS 4.0 score is 5.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity. The vendor has not provided a fix or response, and no cloud service is involved.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected device's management interface, potentially leading to session hijacking or unauthorized actions performed by the victim user. However, the impact is limited as the vulnerability requires user interaction and has low integrity and confidentiality impact. There are no known active exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is provided, restricting access to the management interface and avoiding untrusted input in the Username field may reduce risk. Since the vendor has not responded, caution and network-level protections are advisable.