/goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter.Referenceshttps://gist.github.com/MayurUdiniya/597169f582e506b610beb4e84fd8c8fc
