NetComm NB16WV-02 Cross Site Scripting

`Hi,  
Mitre has provided the following with the CVE number: CVE-2017-5900  
  
there is a Stored XSS vulnerability in a NetComm router's model NB16WV-02  
running version NB16WV_R0.09, If authorized user is able to inject the  
following string  
  
POC:  
Authenticated user is required:  
http://<router_IP>/hdd.htm?rc=&S801F0334=/dkmvc%3C/script  
%3E%3Cscript%3Ealert%28String.fromCharCode%28101,90,101,90%29  
%29%3C/script%3Ed29f  
  
Stored XSS will be injected and execute on the page reload.  
This vulnearbilty can be used to steal session, cookies and many more.  
  
NetComm will be releasing a patch in the coming weeks to address  
this issue.  
  
  
`