GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input making it possible to perform cross-site scripting attacks which may be used to send a malicious script. Also UR Firmware web server does not perform HTML encoding of user-supplied strings.