The Totolink A3002MU router contains a cross-site scripting vulnerability in the Anchor Tag Handler component. This vulnerability allows remote attackers to inject malicious scripts by manipulating anchor tags, leading to potential XSS attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity. Public exploit code is available, but no vendor patch or remediation details have been provided.

Successful exploitation of this vulnerability can lead to cross-site scripting attacks, which may allow attackers to execute arbitrary scripts in the context of the affected device's web interface. This can result in session hijacking, defacement, or other malicious actions depending on the victim's interaction with the device interface. The medium severity reflects moderate risk given the need for user interaction and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the device's web interface and avoid clicking on suspicious links or inputs that could trigger the XSS vulnerability.