A vulnerability was detected in Netis WF2409E 3.3.42541. (CVE-2026-108898)

CVE-2026-108898 describes a cross-site scripting vulnerability in Netis WF2409E firmware version 3.3.42541. The flaw is located in the Wireless Settings component where manipulation of the SSID parameter can lead to script injection. The attack vector is remote network access with low attack complexity, requiring some user interaction and low privileges. The vulnerability impacts the integrity of the system by enabling script execution but does not affect confidentiality or availability. The vendor was contacted but did not provide any response or remediation guidance. Public exploit code exists, increasing the risk of exploitation.

The vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the SSID parameter in the Wireless Settings. This can lead to limited integrity impact such as executing unauthorized scripts in the context of the affected device's web interface. There is no impact on confidentiality or availability. The overall severity is low.

No official fix or patch is currently available from the vendor, who has not responded to disclosure attempts. Users should exercise caution when accessing the device's web interface and avoid interacting with untrusted SSID inputs. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.