CVE-2026-70382

17th percentile - higher than 17% of all known CVEs

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

An attacker could execute malicious script in the browser of a user viewing an affected page, potentially leading to session theft or other actions in the user's context. The risk applies to devices whose web interface renders externally supplied values.

Update the device software to a version containing the output encoding fix. Restrict the ability to influence stored values to trusted sources.