CVE-2026-108898
3.5LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
An authenticated remote attacker can execute arbitrary JavaScript in an administrator's browser session. They need valid credentials to modify the router's wireless settings and an administrator to view the page.
Root cause
The web interface fails to sanitize input in the SSID field within the Wireless Settings component, leading to stored cross-site scripting.
Affected systems
Netis WF2409E version 3.3.42541.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor patch is available; restrict network access to the web management interface or isolate the device on a dedicated administrative VLAN.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.