Description

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-12T15:17:07.803Z",
  "pubdate": "2026-10-12T15:17:07.803Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Wireless Settings component of the Netis WF2409E router, specifically affecting firmware version 3.3.42541.\nThe vulnerability arises from improper sanitization of user-supplied input provided through the SSID parameter.\nThis flaw allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript code within the context of an administrator's browser session.\nThe impact includes the potential for session hijacking, unauthorized configuration changes, and the redirection of traffic to malicious destinations.\nGiven that the vendor has failed to respond to disclosure attempts and public exploit material is available, this vulnerability poses a significant risk to the integrity and security of affected network environments.\nExploitation is feasible over a network connection, making the device susceptible to remote compromise if the web management interface is accessible.",
  "technicalDetails": "The vulnerability is a classic reflected or stored Cross-Site Scripting (XSS) flaw located within the Wireless Settings module of the Netis WF2409E web management interface.\nThe root cause is the failure of the application to properly validate or sanitize the 'SSID' argument before processing and rendering it in the HTML response. When a user or an attacker submits a crafted SSID string containing malicious JavaScript payloads, the application accepts this input and stores it within the device's configuration or reflects it back to the client-side browser without sufficient encoding.\nThe attack flow begins when an attacker identifies the vulnerable input field within the Wireless Settings interface. By injecting a payload (e.g., <script>alert(document.cookie)</script>) into the SSID field, the attacker creates a malicious state on the router.\nWhen a legitimate administrator accesses the wireless configuration page, the router serves the stored malicious payload to the browser. The browser interprets the injected script as legitimate content, executing it within the security context of the administrative session.\nBecause the execution occurs in the administrator's browser, the attacker can leverage the victim's session to perform actions on behalf of the administrator. This includes modifying system configurations, changing DNS settings, or exfiltrating sensitive device information.\nThe vulnerability is accessible remotely, provided the administrative web interface is exposed to the network. No complex authentication is necessarily required to stage the attack if the interface is reachable or if the attacker can influence the configuration values. The lack of output encoding on the 'SSID' parameter ensures that any script tags or event handlers injected via the parameter are executed immediately upon rendering.\nPost-exploitation impact is severe, as it facilitates full control over the router's configuration, potentially leading to persistent man-in-the-middle (MITM) attacks, credential theft, or the permanent compromise of the network gateway for all connected clients."
}