This vulnerability is a cross-site scripting (XSS) flaw in the web interface of Contec's PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US devices. Successful exploitation enables an attacker to execute arbitrary scripts within the browser session of an authenticated user. The affected versions are those prior to 1.01.00. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality and integrity but no impact on availability.

If exploited, an attacker could execute arbitrary scripts in the context of a logged-in user's browser, potentially leading to unauthorized disclosure or modification of information accessible to that user. There is no indication of availability impact. The vulnerability requires the attacker to have network access and the user to be logged in and interact with malicious content.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content while logged into the affected devices.