A reflected cross-site scripting (XSS) vulnerability exists in Automated Logic WebCTRL and Carrier i-VU due to improper sanitization of a specific GET parameter in a URL. This flaw can allow an attacker to deliver malicious payloads to users who click on crafted URLs. The vulnerability has a medium severity rating with a CVSS score of 5.4. No known exploits in the wild or patches are currently documented.