Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update new UI) allows attackers to execute arbitrary JavaScript by modifying the \Domain Name\ field \Server Address\ field \User Name/Email\ or \Password/Key\ field.