This vulnerability is a cross-site scripting (XSS) flaw in Contec Co., Ltd.'s CAN-2-WF device, specifically the CAN 2.0B Communication Wireless LAN / USB Converter Unit. If exploited, an attacker can execute arbitrary scripts on the web browser of a logged-in user, potentially leading to information disclosure or session manipulation. The vulnerability affects all versions starting from 0 up to but excluding version 2.20. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, no privileges, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a logged-in user's browser, which can lead to partial confidentiality and integrity compromise of the affected system. There is no indication of availability impact. No known exploits are reported in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the device's web interface and avoid clicking on untrusted links while logged in.