Vulnerability · Published Apr 25, 2026 · Assigned by VulDB

CVE-2026-7001Datacom DM4100 Ethernet Configuration cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in DM4100 from Datacom. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Datacom	DM4100	1.3.6.1.4.1.3709

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-359560 | Datacom DM4100 Ethernet Configuration cross site scripting vdb-entry, technical-description
VDB-359560 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #797368 | datacom DM4100 1.3.6.1.4.1.3709 Cross Site Scripting third-party-advisory