On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3 1.0.37 1.3.1 1.3.3 1.3.7 1.4.0 and 2.0.22 a reflected Cross-Site Scripting (XSS) attack is possible as a result of missed filtration for special characters in the \Search\ field and incorrect processing of the XMLHttpRequest object.